Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38267)

Description

Liferay Portal through v7.3.6 and Liferay DXP through v7.3 were discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Blog Entry function under the Blog module.

Remediation

References

CVE-2021-38267

Related Vulnerabilities

WordPress Plugin YITH WooCommerce Wishlist SQL Injection (2.1.2)

WordPress Plugin Read and Understood Multiple Vulnerabilities (2.1)

WordPress Plugin WP Airbnb Review Slider SQL Injection (3.2)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-11823)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-43775)

Severity

Medium

Classification

CVE-2021-38267 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N