VULNERABILITY INTELLIGENCE

CVE-2021-33337

CVSS score6.1 MEDIUM

EPSS probability0.80%

CISA KEVNot currently listed

Published2021-08-04

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

cve@mitre.org — Issue Tracking, Vendor Advisory
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory