CVE-2021-38265
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in the Asset module of Liferay Portal 7.3.4 through 7.3.6 allows remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.3.7 or later, which includes a fix for the XSS vulnerability.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.