CVE-2021-38265: Liferay Digital Experience Platform

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Affected products

• Liferay Digital Experience Platform: up to and including 7.3
• Liferay Liferay Portal: from 7.3.4, up to and including 7.3.6

Published 2022-03-03. Last modified 2026-07-09.