CVE-2021-33326: Cross-site Scripting (XSS) Vulnerability in Liferay Portal and Liferay DXP Frontend JS Module
Summary
CVE-2021-33326: Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module. Affects com.liferay:com.liferay.frontend.js.aui.web versions < 4.0.18. Fixed in 4.0.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal and Liferay DXP are popular platforms for building enterprise web applications. They provide a robust framework for developing and managing web content, user interfaces, and business processes. The Frontend JS module is a key component that enables developers to create dynamic user interfaces using JavaScript. However, certain versions of this module are vulnerable to a cross-site scripting (XSS) attack, which can allow malicious actors to inject harmful scripts into web pages viewed by users.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Frontend JS module, specifically in the title of modal windows. This flaw allows remote attackers to inject arbitrary web scripts or HTML, potentially leading to data theft, session hijacking, or other malicious activities. The affected versions include those prior to 4.0.18 for the Frontend JS module, and Liferay Portal 7.3.4 and earlier, as well as Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9.
How To Fix
Minimum fixed version
4.0.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider sanitizing user inputs to prevent script injection. Implement input validation and encoding to ensure that any user-generated content is treated as plain text rather than executable code.
Conclusion
CVE-2021-33326 is a significant cross-site scripting vulnerability affecting Liferay Portal and Liferay DXP. It is crucial for users of these platforms to update to the latest versions to protect against potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for com.liferay:com.liferay.frontend.js.aui.web →
FAQ
CVE-2021-33326 is a cross-site scripting (XSS) vulnerability found in the Frontend JS module of Liferay Portal and Liferay DXP, allowing attackers to inject malicious scripts.
Affected versions include Frontend JS module versions before 4.0.18, Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your pom.xml file. Visit Vulert Scanner to check your application without signup.
The vulnerability can lead to data theft, session hijacking, and other malicious activities, compromising user security and application integrity.
Update your affected packages to the patched versions as specified in the 'how to fix' section, and consider implementing input validation as a temporary workaround.
