Servers and applications

CVE-2021-33339

Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.

Severity: Medium 4.8
Published: 4 Aug 2021
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 7.3.5
Sources: NVD

Affected software

Software	Affected versions
Liferay Portal / DXPServers and applications · `cpe:a:liferay:digital_experience_platform`	Version 7.2-fix_pack_8 Version 7.2-fix_pack_7 Version 7.2-fix_pack_6 Version 7.2-fix_pack_5 All 9 release lines Version 7.2 Version 7.2-fix_pack_1 Version 7.2-fix_pack_2 Version 7.2-fix_pack_3 Version 7.2-fix_pack_4 Version 7.2-fix_pack_5 Version 7.2-fix_pack_6 Version 7.2-fix_pack_7 Version 7.2-fix_pack_8
Liferay Portal / DXPServers and applications · `cpe:a:liferay:liferay_portal`	From 7.2.1 before 7.3.5

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2021-33339
CVE.org https://www.cve.org/CVERecord?id=CVE-2021-33339