CVE-2021-29046

MediumCVSS 6.1

Published: 17/05/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.92%

56th percentile - higher than 56% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. Remote attackers can inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Risk Assessment

Risk of user session theft, account takeover, or unauthorized actions in the victim's context, potentially leading to data leakage or system integrity compromise.

Recommendation

Immediately upgrade Liferay Portal to version 7.3.6 or later, and Liferay DXP 7.3 to fix pack 1 or later. Also consider implementing input filters and output encoding for URL parameters.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.