CVE-2021-38265

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

5.4 MediumFix available

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.58%Down 0.3 points since Mar 3, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2021-38265
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-38265
Updated: 2026-11-02

EUVDEUVD-2021-24723 No score

Record: EUVD-2021-24723
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3x83-whxw-pvmg 5.4

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

Liferay Layout Admin Web before 5.0.0 in Liferay Portal v7.3.6 and below and Liferay DXP v7.3 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Record: GHSA-3x83-whxw-pvmg
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Record: CVE-2021-38265
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-3x83-whxw-pvmg 5.4

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

Record: GHSA-3x83-whxw-pvmg
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVBIT-liferay-2021-38265 No score

Record: BIT-liferay-2021-38265
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.liferay:com.liferay.layout.admin.web` Maven	before 5.0.0	5.0.0
`com.liferay.portal:release.dxp.bom` Maven	through 7.3	None known
`liferay` Bitnami	before 7.3.0	7.3.0
`com.liferay:com.liferay.layout.admin.web` Maven	before 5.0.0, plus listed versions 1.0.01.0.11.0.101.0.1001.0.101 Show 45 moreShow less 1.0.1021.0.1031.0.1041.0.1051.0.1061.0.1071.0.1081.0.1091.0.111.0.1101.0.1111.0.1121.0.1131.0.1141.0.1151.0.1161.0.1171.0.1181.0.1191.0.121.0.1201.0.1211.0.1221.0.1231.0.1241.0.1251.0.1261.0.1271.0.1281.0.1291.0.131.0.1301.0.1311.0.1321.0.1331.0.1341.0.1351.0.1361.0.1371.0.1381.0.1391.0.141.0.1401.0.1411.0.142	5.0.0
`com.liferay.portal:release.dxp.bom` Maven	through 7.3, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less 7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38265 is a medium vulnerability (CVSS 5.4) in Liferay Portal, published March 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in com.liferay:com.liferay.layout.admin.web 5.0.0.

References

This page doesn't list everything

Left out here: 693 versions. The JSON record has them.