CVE-2021-38269
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2. Remote attackers can inject arbitrary web script or HTML via the output of a Gogo Shell command.
Risk Assessment
Risk of user session theft, account takeover, or unauthorized actions in the victim's context. The attack may lead to data leakage or system integrity compromise.
Recommendation
Immediately update Liferay Portal to version 7.3.7 or later, and for DXP apply the respective fix packs (fix pack 23 for 7.1, fix pack 13 for 7.2, fix pack 2 for 7.3).
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.