CVE-2021-29048

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the Layout module's page administration page in Liferay Portal 7.3.4 and 7.3.5, and in Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1. The flaw is triggered via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter, which is not properly sanitized, allowing injection of arbitrary web script or HTML.[1][4]

Exploitation

An attacker with network access to the page administration interface can inject malicious script or HTML into the page name parameter. No special authentication is required beyond the ability to modify site page names, which may be available to users with appropriate permissions. The injected payload is stored and subsequently executed when other users visit the affected page administration page.[1][4]

Impact

Successful exploitation results in stored XSS, enabling the attacker to execute arbitrary web script or HTML in the context of the victim's browser session. This could lead to session hijacking, credential theft, or defacement of the administrative interface, depending on the victim's privileges.[1][4]

Mitigation

Liferay Portal 7.3 users should upgrade to version 7.3 CE GA7 (7.3.6) or later. Liferay DXP 7.2 users should apply fix pack 11, and DXP 7.3 users should apply fix pack 1. No patch is available for the specific 7.3.4 and 7.3.5 versions; upgrading is the recommended course of action.[4]