CVE-2021-29045
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in the Redirect module's administration page in Liferay Portal 7.3.2 through 7.3.5 and Liferay DXP 7.3 before fix pack 1. Attackers can inject arbitrary web script or HTML via the destinationURL parameter.
Risk Assessment
Risk of session theft, admin account takeover, or unauthorized actions performed in the victim's browser context.
Recommendation
Upgrade Liferay Portal to version 7.3.6 or later, and Liferay DXP 7.3 to fix pack 1 or later.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.