Description

Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

Remediation

References

CVE-2021-33328

Related Vulnerabilities

MySQL CVE-2022-21374 Vulnerability (CVE-2022-21374)

WordPress Plugin 3D Product configurator for WooCommerce Arbitrary File Upload (1.5.531)

WordPress 3.9.x PHP Object Injection (3.9 - 3.9.33)

OpenSSL Other Vulnerability (CVE-2014-3571)

WordPress 4.4.x Prototype Pollution (4.4 - 4.4.26)

Severity

Medium

Classification

CVE-2021-33328 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities