← Back

CVE-2021-38263

nvd nist
Published: Mar 3, 2022Modified: Nov 21, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.

Affected (132)

Liferay
2 products
Liferay Portal
Digital Experience Platform
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Liferay Portal
Up to 7.3.2
Configuration B
131 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
Version 7.0
Digital Experience Platform
Version 7.0 fix_pack_100
Digital Experience Platform
Version 7.0 fix_pack_10
Digital Experience Platform
Version 7.0 fix_pack_11
Digital Experience Platform
Version 7.0 fix_pack_12
Digital Experience Platform
Version 7.0 fix_pack_13
Digital Experience Platform
Version 7.0 fix_pack_14
Digital Experience Platform
Version 7.0 fix_pack_15
Digital Experience Platform
Version 7.0 fix_pack_16
Digital Experience Platform
Version 7.0 fix_pack_17
Digital Experience Platform
Version 7.0 fix_pack_18
Digital Experience Platform
Version 7.0 fix_pack_19
Digital Experience Platform
Version 7.0 fix_pack_1
Digital Experience Platform
Version 7.0 fix_pack_20
Digital Experience Platform
Version 7.0 fix_pack_21
Digital Experience Platform
Version 7.0 fix_pack_22
Digital Experience Platform
Version 7.0 fix_pack_23
Digital Experience Platform
Version 7.0 fix_pack_24
Digital Experience Platform
Version 7.0 fix_pack_25
Digital Experience Platform
Version 7.0 fix_pack_26
Digital Experience Platform
Version 7.0 fix_pack_27
Digital Experience Platform
Version 7.0 fix_pack_28
Digital Experience Platform
Version 7.0 fix_pack_29
Digital Experience Platform
Version 7.0 fix_pack_2
Digital Experience Platform
Version 7.0 fix_pack_30
Digital Experience Platform
Version 7.0 fix_pack_31
Digital Experience Platform
Version 7.0 fix_pack_32
Digital Experience Platform
Version 7.0 fix_pack_33
Digital Experience Platform
Version 7.0 fix_pack_34
Digital Experience Platform
Version 7.0 fix_pack_35
Digital Experience Platform
Version 7.0 fix_pack_36
Digital Experience Platform
Version 7.0 fix_pack_37
Digital Experience Platform
Version 7.0 fix_pack_38
Digital Experience Platform
Version 7.0 fix_pack_39
Digital Experience Platform
Version 7.0 fix_pack_3
Digital Experience Platform
Version 7.0 fix_pack_40
Digital Experience Platform
Version 7.0 fix_pack_41
Digital Experience Platform
Version 7.0 fix_pack_42
Digital Experience Platform
Version 7.0 fix_pack_43
Digital Experience Platform
Version 7.0 fix_pack_44
Digital Experience Platform
Version 7.0 fix_pack_45
Digital Experience Platform
Version 7.0 fix_pack_46
Digital Experience Platform
Version 7.0 fix_pack_47
Digital Experience Platform
Version 7.0 fix_pack_48
Digital Experience Platform
Version 7.0 fix_pack_49
Digital Experience Platform
Version 7.0 fix_pack_4
Digital Experience Platform
Version 7.0 fix_pack_50
Digital Experience Platform
Version 7.0 fix_pack_51
Digital Experience Platform
Version 7.0 fix_pack_52
Digital Experience Platform
Version 7.0 fix_pack_53
Digital Experience Platform
Version 7.0 fix_pack_54
Digital Experience Platform
Version 7.0 fix_pack_55
Digital Experience Platform
Version 7.0 fix_pack_56
Digital Experience Platform
Version 7.0 fix_pack_57
Digital Experience Platform
Version 7.0 fix_pack_58
Digital Experience Platform
Version 7.0 fix_pack_59
Digital Experience Platform
Version 7.0 fix_pack_5
Digital Experience Platform
Version 7.0 fix_pack_60
Digital Experience Platform
Version 7.0 fix_pack_61
Digital Experience Platform
Version 7.0 fix_pack_62
Digital Experience Platform
Version 7.0 fix_pack_63
Digital Experience Platform
Version 7.0 fix_pack_64
Digital Experience Platform
Version 7.0 fix_pack_65
Digital Experience Platform
Version 7.0 fix_pack_66
Digital Experience Platform
Version 7.0 fix_pack_67
Digital Experience Platform
Version 7.0 fix_pack_68
Digital Experience Platform
Version 7.0 fix_pack_69
Digital Experience Platform
Version 7.0 fix_pack_6
Digital Experience Platform
Version 7.0 fix_pack_70
Digital Experience Platform
Version 7.0 fix_pack_71
Digital Experience Platform
Version 7.0 fix_pack_72
Digital Experience Platform
Version 7.0 fix_pack_73
Digital Experience Platform
Version 7.0 fix_pack_74
Digital Experience Platform
Version 7.0 fix_pack_75
Digital Experience Platform
Version 7.0 fix_pack_76
Digital Experience Platform
Version 7.0 fix_pack_77
Digital Experience Platform
Version 7.0 fix_pack_78
Digital Experience Platform
Version 7.0 fix_pack_79
Digital Experience Platform
Version 7.0 fix_pack_7
Digital Experience Platform
Version 7.0 fix_pack_80
Digital Experience Platform
Version 7.0 fix_pack_81
Digital Experience Platform
Version 7.0 fix_pack_82
Digital Experience Platform
Version 7.0 fix_pack_83
Digital Experience Platform
Version 7.0 fix_pack_84
Digital Experience Platform
Version 7.0 fix_pack_85
Digital Experience Platform
Version 7.0 fix_pack_86
Digital Experience Platform
Version 7.0 fix_pack_87
Digital Experience Platform
Version 7.0 fix_pack_88
Digital Experience Platform
Version 7.0 fix_pack_89
Digital Experience Platform
Version 7.0 fix_pack_8
Digital Experience Platform
Version 7.0 fix_pack_90
Digital Experience Platform
Version 7.0 fix_pack_91
Digital Experience Platform
Version 7.0 fix_pack_92
Digital Experience Platform
Version 7.0 fix_pack_93
Digital Experience Platform
Version 7.0 fix_pack_94
Digital Experience Platform
Version 7.0 fix_pack_95
Digital Experience Platform
Version 7.0 fix_pack_96
Digital Experience Platform
Version 7.0 fix_pack_97
Digital Experience Platform
Version 7.0 fix_pack_98
Digital Experience Platform
Version 7.0 fix_pack_99
Digital Experience Platform
Version 7.0 fix_pack_9
Digital Experience Platform
Version 7.1
Digital Experience Platform
Version 7.1 fix_pack_10
Digital Experience Platform
Version 7.1 fix_pack_11
Digital Experience Platform
Version 7.1 fix_pack_12
Digital Experience Platform
Version 7.1 fix_pack_13
Digital Experience Platform
Version 7.1 fix_pack_14
Digital Experience Platform
Version 7.1 fix_pack_15
Digital Experience Platform
Version 7.1 fix_pack_16
Digital Experience Platform
Version 7.1 fix_pack_17
Digital Experience Platform
Version 7.1 fix_pack_18
Digital Experience Platform
Version 7.1 fix_pack_19
Digital Experience Platform
Version 7.1 fix_pack_1
Digital Experience Platform
Version 7.1 fix_pack_2
Digital Experience Platform
Version 7.1 fix_pack_3
Digital Experience Platform
Version 7.1 fix_pack_4
Digital Experience Platform
Version 7.1 fix_pack_5
Digital Experience Platform
Version 7.1 fix_pack_6
Digital Experience Platform
Version 7.1 fix_pack_7
Digital Experience Platform
Version 7.1 fix_pack_8
Digital Experience Platform
Version 7.1 fix_pack_9
Digital Experience Platform
Version 7.2
Digital Experience Platform
Version 7.2 fix_pack_1
Digital Experience Platform
Version 7.2 fix_pack_2
Digital Experience Platform
Version 7.2 fix_pack_3
Digital Experience Platform
Version 7.2 fix_pack_4
Digital Experience Platform
Version 7.2 fix_pack_5
Digital Experience Platform
Version 7.2 fix_pack_6
Digital Experience Platform
Version 7.2 fix_pack_7
Digital Experience Platform
Version 7.2 fix_pack_8
Digital Experience Platform
Version 7.2 fix_pack_9

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

Source: cve@mitre.org
Product
Source: cve@mitre.org
Issue TrackingVendor Advisory
Source: cve@mitre.org
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.