Cross-site scripting (XSS) vulnerability in the Site module's membership request…
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.
Why it matters now
EPSS 0.00746 55th percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.3.6com.liferay.portal:release.dxp.bom (Maven): 7.0.10.fp97, 7.1.10.fp21, 7.2.10.fp10 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.liferay.portal:release.portal.bom (Maven) | 7.0.0 to before 7.3.6 | 7.3.6 | Patch available | GHSA-wcr5-3q96-c2gr |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.0.10.fp0 to before 7.0.10.fp97 | 7.0.10.fp97 | Patch available | GHSA-wcr5-3q96-c2gr |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.1.0 to before 7.1.10.fp21 | 7.1.10.fp21 | Patch available | GHSA-wcr5-3q96-c2gr |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.2.0 to before 7.2.10.fp10 | 7.2.10.fp10 | Patch available | GHSA-wcr5-3q96-c2gr |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.3.0 to before 7.3.10.fp1 | 7.3.10.fp1 | Patch available | GHSA-wcr5-3q96-c2gr |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.liferay.portal:release.portal.bom (Maven) Vendor— Affected 7.0.0 to before 7.3.6 Fixed in 7.3.6 Patch available GHSA-wcr5-3q96-c2gr
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.0.10.fp0 to before 7.0.10.fp97 Fixed in 7.0.10.fp97 Patch available GHSA-wcr5-3q96-c2gr
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.0 to before 7.1.10.fp21 Fixed in 7.1.10.fp21 Patch available GHSA-wcr5-3q96-c2gr
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp10 Fixed in 7.2.10.fp10 Patch available GHSA-wcr5-3q96-c2gr
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.0 to before 7.3.10.fp1 Fixed in 7.3.10.fp1 Patch available GHSA-wcr5-3q96-c2gr
CPE configurations NVD · 98
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* | 7.0 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* | 7.0 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* | 7.0 fix_pack_24 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* | 7.0 fix_pack_25 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* | 7.0 fix_pack_26 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* | 7.0 fix_pack_27 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* | 7.0 fix_pack_28 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* | 7.0 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* | 7.0 fix_pack_30 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* Versions 7.0 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
Show 88 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* | 7.0 fix_pack_33 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* | 7.0 fix_pack_35 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* | 7.0 fix_pack_36 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* | 7.0 fix_pack_39 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* | 7.0 fix_pack_40 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* | 7.0 fix_pack_41 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* | 7.0 fix_pack_42 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* | 7.0 fix_pack_43 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* | 7.0 fix_pack_44 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* | 7.0 fix_pack_45 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* | 7.0 fix_pack_46 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* | 7.0 fix_pack_47 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* | 7.0 fix_pack_48 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* | 7.0 fix_pack_49 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* | 7.0 fix_pack_50 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* | 7.0 fix_pack_51 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* | 7.0 fix_pack_52 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* | 7.0 fix_pack_53 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* | 7.0 fix_pack_54 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* | 7.0 fix_pack_56 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* | 7.0 fix_pack_57 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* | 7.0 fix_pack_58 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* | 7.0 fix_pack_59 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* | 7.0 fix_pack_60 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* | 7.0 fix_pack_61 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* | 7.0 fix_pack_64 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* | 7.0 fix_pack_65 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* | 7.0 fix_pack_66 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* | 7.0 fix_pack_67 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* | 7.0 fix_pack_68 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* | 7.0 fix_pack_69 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* | 7.0 fix_pack_70 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* | 7.0 fix_pack_71 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* | 7.0 fix_pack_72 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* | 7.0 fix_pack_73 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* | 7.0 fix_pack_75 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* | 7.0 fix_pack_76 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* | 7.0 fix_pack_78 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* | 7.0 fix_pack_79 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* | 7.0 fix_pack_80 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* | 7.0 fix_pack_81 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* | 7.0 fix_pack_82 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* | 7.0 fix_pack_83 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* | 7.0 fix_pack_84 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* | 7.0 fix_pack_85 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* | 7.0 fix_pack_86 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* | 7.0 fix_pack_87 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* | 7.0 fix_pack_88 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* | 7.0 fix_pack_89 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* | 7.0 fix_pack_90 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* | 7.0 fix_pack_91 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* | 7.0 fix_pack_92 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* | 7.0 fix_pack_93 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* | 7.0 fix_pack_94 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* | 7.0 fix_pack_95 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:* | 7.0 fix_pack_96 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* | 7.1 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* | 7.1 fix_pack_10 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* | 7.1 fix_pack_11 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* | 7.1 fix_pack_12 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* | 7.1 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* | 7.1 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* | 7.1 fix_pack_15 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* | 7.1 fix_pack_16 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* | 7.1 fix_pack_17 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* | 7.1 fix_pack_18 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* | 7.1 fix_pack_19 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* | 7.1 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:* | 7.1 fix_pack_20 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* | 7.1 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* | 7.1 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* | 7.1 fix_pack_5 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* | 7.1 fix_pack_6 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* | 7.1 fix_pack_7 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* | 7.1 fix_pack_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* | 7.1 fix_pack_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* | 7.2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* | 7.2 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* | 7.2 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* | 7.2 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* | 7.2 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* | 7.2 fix_pack_5 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* | 7.2 fix_pack_6 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* | 7.2 fix_pack_7 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* | 7.2 fix_pack_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* | 7.2 fix_pack_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* | 7.3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* | 7.0.0 – 7.3.5 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* Versions 7.0 fix_pack_83 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* Versions 7.0 fix_pack_84 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* Versions 7.0 fix_pack_85 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* Versions 7.0 fix_pack_86 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* Versions 7.0 fix_pack_87 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* Versions 7.0 fix_pack_88 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* Versions 7.0 fix_pack_89 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* Versions 7.0 fix_pack_90 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* Versions 7.0 fix_pack_91 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* Versions 7.0 fix_pack_92 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* Versions 7.0 fix_pack_93 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* Versions 7.0 fix_pack_94 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* Versions 7.0 fix_pack_95 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:* Versions 7.0 fix_pack_96 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* Versions 7.1 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* Versions 7.1 fix_pack_10 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* Versions 7.1 fix_pack_11 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* Versions 7.1 fix_pack_12 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* Versions 7.1 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* Versions 7.1 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* Versions 7.1 fix_pack_15 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* Versions 7.1 fix_pack_16 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* Versions 7.1 fix_pack_17 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* Versions 7.1 fix_pack_18 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* Versions 7.1 fix_pack_19 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* Versions 7.1 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:* Versions 7.1 fix_pack_20 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* Versions 7.1 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* Versions 7.1 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* Versions 7.1 fix_pack_5 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* Versions 7.1 fix_pack_6 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* Versions 7.1 fix_pack_7 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* Versions 7.1 fix_pack_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* Versions 7.1 fix_pack_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* Versions 7.2 fix_pack_5 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* Versions 7.2 fix_pack_6 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* Versions 7.2 fix_pack_7 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* Versions 7.2 fix_pack_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* Versions 7.2 fix_pack_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.3.5 Vulnerable ·Liferay
Remediation
- Fix · GHSA-wcr5-3q96-c2gr com.liferay.portal:release.portal.bom (Maven) Fixed in 7.3.6 Advisory →
- Fix · GHSA-wcr5-3q96-c2gr com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.0.10.fp97 Advisory →
- Fix · GHSA-wcr5-3q96-c2gr com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.1.10.fp21 Advisory →
- Fix · GHSA-wcr5-3q96-c2gr com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp10 Advisory →
- Fix · GHSA-wcr5-3q96-c2gr com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.10.fp1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29044
- 2026-10-03 Alias added: GHSA-wcr5-3q96-c2gr
References
Advisory 2
More Liferay Digital Experience Platform vulnerabilities
- TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
- TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
- TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
- TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
Sources
- CVE-2021-29044 · CVE Program
- CVE-2021-29044 · NVD
- FIRST EPSS
- GHSA-wcr5-3q96-c2gr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences