VYPR
← All advisories
Medium severity6.1NVD Advisory· Published May 17, 2021· Updated Jul 9, 2026

CVE-2021-29048

CVE-2021-29048

Description

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.3.4, < 7.3.67.3.6
com.liferay.portal:release.dxp.bomMaven
< 7.2.10.fp117.2.10.fp11
com.liferay.portal:release.dxp.bomMaven
>= 7.3.0, < 7.3.10.fp17.3.10.fp1

Affected products

17
  • Liferay/Digital Experience Platform11 versions
    cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
  • Liferay/DXP
    cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:7.3.4:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:7.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*
  • Liferay/Portaldescription
  • ghsa-coords2 versions
    pkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay.portal/release.portal.bom
    < 7.2.10.fp11+ 1 more
    • (no CPE)range: < 7.2.10.fp11
    • (no CPE)range: >= 7.3.4, < 7.3.6

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.