CVE-2021-29049

MediumCVSS 6.1

Published: 09/06/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

50th percentile - higher than 50% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP. Allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browser, compromising data confidentiality and integrity.

Recommendation

Immediately update Liferay DXP to a version containing the appropriate fix pack (7.0 FP99, 7.1 FP23, 7.2 FP12, 7.3 FP1 or later).

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.