CVE-2021-38263

描述

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.

如何修補 CVE-2021-38263

要修補 CVE-2021-38263,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —未列出修補版本
• —升級至 4.0.12 或更新版本

CVE-2021-38263 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• >= 7.0.0, <= 7.0.0, >= 7.1.0, <= 7.1.0, >= 7.2.0, <= 7.2.0 | >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.0-fix.0, <= 7.0-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.1-fix.0, <= 7.1-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0, >= 7.2-fix.0, <= 7.2-fix.0

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-38263
• PATCHgithub.com/liferay/liferay-portal
• WEBliferay.com
• WEBgithub.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f6
• WEB