CVE-2021-29039

MediumCVSS 6.1

Published: 16/05/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

50th percentile - higher than 50% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update Liferay Portal to a patched version or apply available security fixes, and implement input validation in the Asset module.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.