CVE-2021-38267

MediumCVSS 5.4

Published: 03/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

43th percentile - higher than 43% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in the Blogs module of Liferay Portal 7.3.2 through 7.3.6 and Liferay DXP 7.3 before fix pack 2. Attackers can inject arbitrary web script or HTML via the title and subtitle parameters on the edit blog entry page.

Risk Assessment

Risk of session hijacking, admin account takeover, or sensitive data leakage due to malicious script execution in the victim's browser.

Recommendation

Immediately upgrade Liferay Portal to version 7.3.7 or later, or apply fix pack 2 for Liferay DXP 7.3.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.