CVE-2021-29051: XSS

Q: What is the severity of CVE-2021-29051?

The severity of CVE-2021-29051 is medium.

Q: How does CVE-2021-29051 affect Liferay Portal and Liferay DXP?

CVE-2021-29051 affects Liferay Portal versions 7.2.1 through 7.3.5, and Liferay DXP versions 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 1.

Q: What is the vulnerability in CVE-2021-29051?

The vulnerability in CVE-2021-29051 is a cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app.

Q: How can CVE-2021-29051 be exploited?

CVE-2021-29051 can be exploited by remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset parameter.

Q: Where can I find more information about CVE-2021-29051?

More information about CVE-2021-29051 can be found at the following references: [http://liferay.com](http://liferay.com), [https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580](https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580)

Published May 17, 2021

Updated

Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the comliferayassetpublisherwebportletAssetPublisherPortletINSTANCEXXXXXXXXXXXXassetEntryId parameter.

Affected Software

68 affected componentsFixes available

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_20

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay Liferay Portal>=7.2.0<=7.3.5

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_20

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

maven/com.liferay.portal:release.dxp.bom>=7.3.0<7.3.10.fp1

7.3.10.fp1

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp10

7.2.10.fp10

maven/com.liferay.portal:release.dxp.bom<7.1.10.fp21

7.1.10.fp21

maven/com.liferay.portal:release.portal.bom>=7.2.1<=7.3.5

7.3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.3.10.fp1
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.2.10.fp10
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.1.10.fp21
Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.3.6
Upgrade
Upgrade Liferay Portal 7.2 (Asset module Asset Publisher) to a version that resolves this vulnerability.
Fixed in 7.2Patch fix pack 10
Upgrade
Upgrade Liferay Portal 7.3 (Asset module Asset Publisher) to a version that resolves this vulnerability.
Fixed in 7.3Patch fix pack 1

Event History

May 17, 2021

CVE Published

via MITRE·11:01 AM

Data Sourced

via MITRE·11:01 AM

Description

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:02 PM

Frequently Asked Questions

What is the severity of CVE-2021-29051?

The severity of CVE-2021-29051 is medium.

How does CVE-2021-29051 affect Liferay Portal and Liferay DXP?