CVE-2021-33339: XSS

Q: What is CVE-2021-33339?

CVE-2021-33339 is a cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9, which allows remote attackers to inject arbitrary web script or HTML.

Q: How severe is CVE-2021-33339?

CVE-2021-33339 has a severity rating of 4.8 (medium).

Q: What is the affected software for CVE-2021-33339?

The affected software for CVE-2021-33339 includes Liferay Portal 7.2.1 through 7.3.4 and Liferay DXP 7.2 before fix pack 9.

Q: How can I fix CVE-2021-33339?

To fix CVE-2021-33339, update your Liferay software to version 7.2-fix_pack_9 or higher.

Q: Where can I find more information about CVE-2021-33339?

You can find more information about CVE-2021-33339 at the following references: [link1](https://issues.liferay.com/browse/LPE-17102) [link2](https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934)

Published Aug 4, 2021

Updated

Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the comliferaysiteadminwebportletSiteAdminPortletname parameter.

Affected Software

21 affected componentsFixes available

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay Liferay Portal>=7.2.1<7.3.5

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp9

7.2.10.fp9

maven/com.liferay.portal:release.portal.bom>=7.2.1<=7.3.4

7.3.5

Remediation

Patch Available

https://issues.liferay.com/browse/LPE-17102

Event History

Aug 4, 2021

CVE Published

via MITRE·12:48 PM

Data Sourced

via MITRE·12:48 PM

Description

Data Sourced

via NVD·01:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:10 PM

Frequently Asked Questions

What is CVE-2021-33339?

CVE-2021-33339 is a cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9, which allows remote attackers to inject arbitrary web script or HTML.

How severe is CVE-2021-33339?