What is CVE-2021-29046?

CVE-2021-29046 is a medium-severity vulnerability in Liferay Dxp, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-05-17.

How severe is CVE-2021-29046?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Liferay Dxp

CVE-2021-29046

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (55.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Liferay Dxp — versions 7.3
Liferay Liferay_portal — versions 7.3.5
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

af854a3a-2127-422b-91ae-364da2661108 (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-29046?: CVE-2021-29046 is a medium-severity vulnerability in Liferay Dxp, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-05-17.
How severe is CVE-2021-29046?: Medium severity. CVSS v3 base score is 6.1 out of 10.