CVE-2021-35463: Liferay Portal Frontend Taglib Module XSS Vulnerability
Summary
CVE-2021-35463: Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0, < 7.4.1. Fixed in 7.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Liferay Portal is a popular open-source platform for building web applications and managing digital experiences. It provides a robust set of features, including content management, collaboration tools, and customizable user interfaces. The Frontend Taglib module is a key component that facilitates the integration of frontend technologies within Liferay applications. However, a vulnerability in this module has been identified, which could allow attackers to exploit the system through cross-site scripting (XSS).
Vulnerability Detail
The vulnerability, identified as CVE-2021-35463, is a cross-site scripting (XSS) issue in the Frontend Taglib module of Liferay Portal version 7.4.0. It allows remote attackers to inject arbitrary web scripts or HTML into the management toolbar search via the 'keywords' parameter. This could lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive information and the integrity of the application.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization on the 'keywords' parameter to mitigate the risk of XSS attacks. This can be done by encoding user inputs or using libraries that provide XSS protection.
Conclusion
In summary, CVE-2021-35463 is a significant cross-site scripting vulnerability in the Liferay Portal Frontend Taglib module that can lead to serious security risks. It is crucial to update to the patched version or implement workarounds to protect your application from potential attacks.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2021-35463 is a cross-site scripting (XSS) vulnerability found in the Frontend Taglib module of Liferay Portal version 7.4.0.
This vulnerability can allow attackers to inject malicious scripts into your application, potentially leading to data theft, session hijacking, or unauthorized actions.
The vulnerability affects Liferay Portal version 7.4.0. It is recommended to upgrade to version 7.4.1 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score for CVE-2021-35463 is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
