TI-2021-09936 Aliases CVE-2021-29046 GHSA-9g57-m5vf-qp73

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input…

LOW 29CWE-79Published 2021-05-17 · Updated 2026-07-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Why it matters now

EPSS 0.0088 59th percentileScored 2026-11-07

Fix Fixed com.liferay.portal:release.dxp.bom (Maven): 7.3.10.fp1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.liferay.portal:release.portal.bom (Maven)	—	—	No fix listed	GHSA-9g57-m5vf-qp73
—	com.liferay.portal:release.dxp.bom (Maven)	7.3.10.fp0 to before 7.3.10.fp1	7.3.10.fp1	Patch available	GHSA-9g57-m5vf-qp73

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.liferay.portal:release.portal.bom (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-9g57-m5vf-qp73
com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.10.fp0 to before 7.3.10.fp1 Fixed in 7.3.10.fp1 Patch available GHSA-9g57-m5vf-qp73

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:liferay:dxp:7.3:-::::::	7.3	Vulnerable	Liferay
cpe:2.3:a:liferay:liferay_portal:7.3.5:::::::*	7.3.5	Vulnerable	Liferay

cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Liferay
cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Liferay

Remediation

Fix · GHSA-9g57-m5vf-qp73 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.10.fp1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-29046
2026-10-03 Alias added: GHSA-9g57-m5vf-qp73

References

Advisory 2

Other 2

TI-2022-18349 A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic… CVSS 3.1MEDIUM 5.4
TI-2022-18348 A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload… CVSS 3.1MEDIUM 5.4
TI-2022-20404 A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and… CVSS 3.1CRITICAL 9.8
TI-2022-20402 A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through… CVSS 3.1CRITICAL 9.8
TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
TI-2024-16596 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences