CVE-2021-29051

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-29051
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://liferay.com Vendor Advisory
http://liferay.com Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
History

13 May 2025, 18:17

Type Values Removed Values Added
CPE cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*		 cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*
References (MISC) http://liferay.com - Vendor Advisory () http://liferay.com - Vendor Advisory
References (MISC) https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 - Vendor Advisory () https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 - Vendor Advisory
First Time Liferay digital Experience Platform
Information

Published : 2021-05-17 12:15

Updated : 2025-05-13 18:17

NVD link : CVE-2021-29051

Mitre link : CVE-2021-29051

JSON object : View

Products Affected

liferay

  • digital_experience_platform
  • liferay_portal
  • dxp
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')