CVE-2021-33337: Liferay Document Library Module XSS Vulnerability
Summary
CVE-2021-33337: Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module. Affects com.liferay:com.liferay.document.library.web versions >= 5.0.6, < 5.0.54. Fixed in 5.0.54. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Liferay Document Library module is a component of the Liferay Portal and Liferay DXP platforms, which are widely used for building enterprise web applications. This module allows users to manage documents and media files efficiently. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack, which can compromise the security of applications built on these platforms.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the add document menu of the Document Library module. Specifically, the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter is susceptible to XSS attacks, allowing remote attackers to inject arbitrary web scripts or HTML. This can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware. The affected versions include 5.0.6 to before 5.0.54, Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9.
How To Fix
Minimum fixed version
5.0.54
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization for the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter to mitigate the risk of XSS attacks. Ensure that any user-generated content is properly escaped before being rendered in the application.
Conclusion
The CVE-2021-33337 vulnerability poses a significant risk to applications using the Liferay Document Library module. It is crucial for developers and system administrators to apply the necessary patches or implement workarounds to safeguard their applications from potential XSS attacks.
See every vulnerability recorded for com.liferay:com.liferay.document.library.web →
FAQ
CVE-2021-33337 is a cross-site scripting (XSS) vulnerability found in the Liferay Document Library module, which allows attackers to inject malicious scripts.
The vulnerability affects versions 5.0.6 to before 5.0.54 of the Document Library module, Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without signing up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and the potential spread of malware through compromised user sessions.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.document.library.web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
