Vulnerability · Published Aug 4, 2021 · Assigned by mitre
CVE-2021-35463
Medium 6.1
In plain English
A medium-severity security flaw in the com.liferay.portal:release.portal.bom package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.9%top 41.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.1 | GHSA-9h7f-5hc8-cj5f |
| Maven | com.liferay:com.liferay.frontend.taglib.clay | 7.1.15 | GHSA-9h7f-5hc8-cj5f |