VULNERABILITY INTELLIGENCE

CVE-2021-38263

CVSS score6.1 MEDIUM

EPSS probability0.88%

CISA KEVNot currently listed

Published2022-03-03

Last modified2026-07-09

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

cve@mitre.org — Issue Tracking, Vendor Advisory
cve@mitre.org — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory