CVE-2021-38263

MediumCVSS 6.1

Published: 03/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.86%

54th percentile - higher than 54% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10. Remote attackers can inject arbitrary web script or HTML via the output of a script.

Risk Assessment

The risk involves execution of malicious script in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade Liferay Portal to version 7.3.3 or later, and for Liferay DXP apply the appropriate fix pack: 7.0 FP101, 7.1 FP20, or 7.2 FP10.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.