VULNERABILITY INTELLIGENCE

CVE-2021-29046

CVSS score6.1 MEDIUM
EPSS probability0.88%
CISA KEVNot currently listed
Published2021-05-17
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Weakness classification

  • nvd@nist.gov: CWE-79

Primary references