Servers and applications

CVE-2021-38265

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Severity: Medium 5.4
Published: 3 Mar 2022
Last changed: 9 Jul 2026
Added to UpHeron: 1 Nov 2026
Sources: NVD

Affected software

Software	Affected versions
Liferay Portal / DXPServers and applications · `cpe:a:liferay:digital_experience_platform`	Every version up to 7.3
Liferay Portal / DXPServers and applications · `cpe:a:liferay:liferay_portal`	From 7.3.4 up to 7.3.6

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2021-38265
CVE.org https://www.cve.org/CVERecord?id=CVE-2021-38265