Lucene search
Veracode Vulnerability DatabaseVERACODE:34552HistoryMar 07, 2022 - 10:08 a.m.
Cross-site Scripting (XSS)
2022-03-0710:08:45
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
23
0.001 Low
EPSS
Percentile
49.6%
Liferay Frontend Taglib Clay is vulnerable to cross-site scripting. The vulnerability exists in processStartTag function of ManagementToolbarTag.java because the keyword in the search function is not escaped which allows an attacker to inject and execute arbitrary javascript.
| CPE | Name | Operator | Version |
|---|---|---|---|
| com.liferay.frontend.taglib.clay | le | 7.1.9 | |
| com.liferay.frontend.taglib.clay | le | 7.1.9 |
References
liferay.com
github.com/advisories/GHSA-ffmm-5ww2-g3q4
github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch
github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b
issues.liferay.com/browse/LPE-17061
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-page
Related
cnvd
cnvd
cvelist
cvelist
CVE-2021-38263
2022-03-02 23:10:21
osv
osv
BIT-liferay-2021-38263
2024-01-31 15:22:16
CVE-2021-38263
2022-03-03 00:15:07
nvd
nvd
CVE-2021-38263
2022-03-03 00:15:07
prion
prion
Cross site scripting
2022-03-03 00:15:00
cve
cve
CVE-2021-38263
2022-03-03 00:15:07