GitHub Advisoryadvisory · Maven

GHSA-w28v-87g6-cjr6 Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter

MEDIUM Published 2022-05-24 Modified 2025-05-14 Official page ↗
Aliases
CVE-2021-29049
Ecosystem
Maven
Packages
com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-05-14

Affected packages

• Maven com.liferay.portal:release.dxp.bom: >= 7.0, < 7.0.10.fp99 → fixed in 7.0.10.fp99 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp23 → fixed in 7.1.10.fp23 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp12 → fixed in 7.2.10.fp12 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.fp1 → fixed in 7.3.10.fp1

Description

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

Related

Alias · CVE (1)

  • CVE-2021-29049 Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References