CVE-2021-29049
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP. Allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browser, compromising data confidentiality and integrity.
Recommendation
Immediately update Liferay DXP to a version containing the appropriate fix pack (7.0 FP99, 7.1 FP23, 7.2 FP12, 7.3 FP1 or later).
Other vulnerabilities in Liferay DXP
See all- CVE-2025-62241Medium
Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users from one virtual instance to view the shipment addresses of a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
- CVE-2021-29041Medium
A denial-of-service vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by enabling TOTP on behalf of another user or modifying the other user's TOTP shared secret.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS