CVE-2021-33337: XSS

Q: What is CVE-2021-33337?

CVE-2021-33337 is a cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal and Liferay DXP.

Q: How does CVE-2021-33337 affect Liferay Portal?

CVE-2021-33337 affects Liferay Portal versions 7.3.0 through 7.3.4.

Q: How does CVE-2021-33337 affect Liferay DXP?

CVE-2021-33337 affects Liferay DXP versions 7.1 before fix pack 20, and 7.2 before fix pack 9.

Q: What is the severity of CVE-2021-33337?

CVE-2021-33337 has a severity keyword of medium and a severity value of 6.1.

Q: How can I fix CVE-2021-33337?

To fix CVE-2021-33337, you should update to the latest version of Liferay Portal or Liferay DXP that includes the fix pack.

Published Aug 4, 2021

Updated

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the comliferaydocumentlibrarywebportletDLAdminPortletname parameter.

Other sources

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu versions 5.0.6 to before 5.0.54, in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the comliferaydocumentlibrarywebportletDLAdminPortletname parameter.

— GitHub

Affected Software

62 affected componentsFixes available

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay Liferay Portal>=7.3.0<=7.3.4

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp9

7.2.10.fp9

maven/com.liferay.portal:release.dxp.bom>=7.1.0<7.1.10.fp20

7.1.10.fp20

maven/com.liferay:com.liferay.document.library.web>=5.0.6<5.0.54

5.0.54

Event History

Aug 4, 2021

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:10 PM

Data Sourced

via GitHub·07:10 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-33337?

CVE-2021-33337 is a cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal and Liferay DXP.

How does CVE-2021-33337 affect Liferay Portal?

CVE-2021-33337 affects Liferay Portal versions 7.3.0 through 7.3.4.

How does CVE-2021-33337 affect Liferay DXP?

CVE-2021-33337 affects Liferay DXP versions 7.1 before fix pack 20, and 7.2 before fix pack 9.

What is the severity of CVE-2021-33337?

CVE-2021-33337 has a severity keyword of medium and a severity value of 6.1.

How can I fix CVE-2021-33337?

To fix CVE-2021-33337, you should update to the latest version of Liferay Portal or Liferay DXP that includes the fix pack.

CVE-2021-33337: XSS

Other sources

Affected Software

Event History

Frequently Asked Questions

What is CVE-2021-33337?

How does CVE-2021-33337 affect Liferay Portal?

How does CVE-2021-33337 affect Liferay DXP?

What is the severity of CVE-2021-33337?

How can I fix CVE-2021-33337?

Company

Resources

Contact