VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Aug 4, 2021· Updated Jun 17, 2026

CVE-2021-33336

CVE-2021-33336

Description

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.3.0, < 7.3.47.3.4
com.liferay.portal:release.dxp.bomMaven
>= 7.1.0, < 7.1.10.fp187.1.10.fp18
com.liferay.portal:release.dxp.bomMaven
>= 7.2.10.fp5, < 7.2.10.fp77.2.10.fp7

Affected products

25
  • Liferay/Digital Experience Platform21 versions
    cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*+ 20 more
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
  • Liferay/Portal
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
    Range: >=7.3.0,<7.3.4
  • Liferay/Liferay Portaldescription
  • ghsa-coords2 versions
    pkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay.portal/release.portal.bom
    >= 7.1.0, < 7.1.10.fp18+ 1 more
    • (no CPE)range: >= 7.1.0, < 7.1.10.fp18
    • (no CPE)range: >= 7.3.0, < 7.3.4

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.