Medium severity6.1NVD Advisory· Published May 16, 2021· Updated Jul 9, 2026

CVE-2021-29039

Description

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bomMaven	>= 7.3.4, < 7.3.5	7.3.5

Affected products

Liferay/Portal
cpe:2.3:a:liferay:liferay_portal:7.3.4:*:*:*:*:*:*:*
Liferay/Liferay Portaldescription
ghsa-coords
pkg:maven/com.liferay.portal/release.portal.bom
Range: >= 7.3.4, < 7.3.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-239w-4f3w-cfcvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-29039ghsaADVISORY
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766nvdVendor Advisory
liferay.comghsaWEB
web.archive.org/web/20220828222833/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000