Executive brief
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)
Affected products
- Maven com.liferay.portal:release.dxp.bom
- Maven com.liferay:com.liferay.layout.admin.web
Junglewise Threat Intelligence
CVE-2021-38265: Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)
CVE-2021-38265 · Severity: low · CVSS 3.1 · Published 2022-03-04
Technologies: com.liferay.portal:release.dxp.bom (Maven), com.liferay:com.liferay.layout.admin.web (Maven). Vendors: Maven.
Related threats
- Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
- Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter
- Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
- Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
- Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API