CVE-2021-38267

MEDIUM

Liferay Portal 7.3.2-7.3.6 & DXP 7.3 < FP2 - Stored XSS via Blog Entry Title/Subtitle

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.

References (2)

Core 2

Core References

Product x_refsource_misc

http://liferay.com

Patch, Vendor Advisory x_refsource_misc

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry

Scores

CVSS v3 5.4

EPSS 0.0018

EPSS Percentile 38.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (6)

com.liferay/com.liferay.frontend.js.web 0 - 5.0.0Maven

com.liferay.portal/release.dxp.bom 7.3.0 - 7.3.10.fp2Maven

com.liferay.portal/release.portal.bom 7.3.2 - 7.3.7-ga8Maven

liferay/digital_experience_platform 7.3 (2 CPE variants)

liferay/digital_experience_platform < 7.3

liferay/liferay_portal 7.3.2 - 7.3.6

Published Mar 03, 2022

Tracked Since Feb 18, 2026