CVE-2021-33336 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2021-33336

Modified

More Info Official Page

Source-cve@mitre.org

Published At-04 Aug, 2021 | 13:15

Updated At-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*

>>digital_experience_platform>>7.1

cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*

>>digital_experience_platform>>7.2

cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*

>>digital_experience_platform>>7.2

cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*

>>digital_experience_platform>>7.2

cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*

>>liferay_portal>>Versions from 7.3.0(inclusive) to 7.3.4(exclusive)

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://issues.liferay.com/browse/LPE-17078	cve@mitre.org	Patch Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name	cve@mitre.org	Release Notes Vendor Advisory
https://issues.liferay.com/browse/LPE-17078	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory