UpHeron
All vulnerabilities

Servers and applications

CVE-2021-29049

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

Severity
Medium 6.1
Published
9 Jun 2021
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.2-fix_pack_11
  • Version 7.2-fix_pack_10
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_8
All 103 release lines
  • Version 7.0
  • Version 7.0-fix_pack_3
  • Version 7.0-fix_pack_13
  • Version 7.0-fix_pack_14
  • Version 7.0-fix_pack_24
  • Version 7.0-fix_pack_25
  • Version 7.0-fix_pack_26
  • Version 7.0-fix_pack_27
  • Version 7.0-fix_pack_28
  • Version 7.0-fix_pack_30
  • Version 7.0-fix_pack_33
  • Version 7.0-fix_pack_35
  • Version 7.0-fix_pack_36
  • Version 7.0-fix_pack_39
  • Version 7.0-fix_pack_40
  • Version 7.0-fix_pack_41
  • Version 7.0-fix_pack_42
  • Version 7.0-fix_pack_43
  • Version 7.0-fix_pack_44
  • Version 7.0-fix_pack_45
  • Version 7.0-fix_pack_46
  • Version 7.0-fix_pack_47
  • Version 7.0-fix_pack_48
  • Version 7.0-fix_pack_49
  • Version 7.0-fix_pack_50
  • Version 7.0-fix_pack_51
  • Version 7.0-fix_pack_52
  • Version 7.0-fix_pack_53
  • Version 7.0-fix_pack_54
  • Version 7.0-fix_pack_56
  • Version 7.0-fix_pack_57
  • Version 7.0-fix_pack_58
  • Version 7.0-fix_pack_59
  • Version 7.0-fix_pack_60
  • Version 7.0-fix_pack_61
  • Version 7.0-fix_pack_64
  • Version 7.0-fix_pack_65
  • Version 7.0-fix_pack_66
  • Version 7.0-fix_pack_67
  • Version 7.0-fix_pack_68
  • Version 7.0-fix_pack_69
  • Version 7.0-fix_pack_70
  • Version 7.0-fix_pack_71
  • Version 7.0-fix_pack_72
  • Version 7.0-fix_pack_73
  • Version 7.0-fix_pack_75
  • Version 7.0-fix_pack_76
  • Version 7.0-fix_pack_78
  • Version 7.0-fix_pack_79
  • Version 7.0-fix_pack_80
  • Version 7.0-fix_pack_81
  • Version 7.0-fix_pack_82
  • Version 7.0-fix_pack_83
  • Version 7.0-fix_pack_84
  • Version 7.0-fix_pack_85
  • Version 7.0-fix_pack_86
  • Version 7.0-fix_pack_87
  • Version 7.0-fix_pack_88
  • Version 7.0-fix_pack_89
  • Version 7.0-fix_pack_90
  • Version 7.0-fix_pack_91
  • Version 7.0-fix_pack_92
  • Version 7.0-fix_pack_93
  • Version 7.0-fix_pack_94
  • Version 7.0-fix_pack_95
  • Version 7.0-fix_pack_96
  • Version 7.0-sp2
  • Version 7.0-sp5
  • Version 7.1
  • Version 7.1-fix_pack_1
  • Version 7.1-fix_pack_2
  • Version 7.1-fix_pack_3
  • Version 7.1-fix_pack_4
  • Version 7.1-fix_pack_5
  • Version 7.1-fix_pack_6
  • Version 7.1-fix_pack_7
  • Version 7.1-fix_pack_8
  • Version 7.1-fix_pack_9
  • Version 7.1-fix_pack_10
  • Version 7.1-fix_pack_11
  • Version 7.1-fix_pack_12
  • Version 7.1-fix_pack_13
  • Version 7.1-fix_pack_14
  • Version 7.1-fix_pack_15
  • Version 7.1-fix_pack_16
  • Version 7.1-fix_pack_17
  • Version 7.1-fix_pack_18
  • Version 7.1-fix_pack_19
  • Version 7.1-fix_pack_20
  • Version 7.1-fix_pack_21
  • Version 7.1-fix_pack_22
  • Version 7.2
  • Version 7.2-fix_pack_1
  • Version 7.2-fix_pack_2
  • Version 7.2-fix_pack_3
  • Version 7.2-fix_pack_4
  • Version 7.2-fix_pack_5
  • Version 7.2-fix_pack_6
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_10
  • Version 7.2-fix_pack_11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-29049
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-29049