Lucene search

MitreCVE-2021-38267

HistoryMar 03, 2022 - 12:15 a.m.

CVE-2021-38267

2022-03-0300:15:08

CWE-79

mitre

web.nvd.nist.gov

cve-2021-38267

xss

liferay portal

blogs module

web security

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Cross-site scripting (XSS) vulnerability in the Blogs module’s edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.

Affected configurations

Nvd

Node

liferaydigital_experience_platformRange<7.3

liferaydigital_experience_platformMatch7.3-

liferaydigital_experience_platformMatch7.3fix_pack_1

liferayliferay_portalRange7.3.2–7.3.6

VendorProductVersionCPE
liferaydigital_experience_platform*cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
liferaydigital_experience_platform7.3cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
liferaydigital_experience_platform7.3cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	*	cpe:2.3:a:liferay:digital_experience_platform::::::::
liferay	digital_experience_platform	7.3	cpe:2.3:a:liferay:digital_experience_platform:7.3:-::::::
liferay	digital_experience_platform	7.3	cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1::::::
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal::::::::

References

liferay.com

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2021-38267