CVE:CVE-2021-29044
CNNVD:CNNVD-202105-807
Liferay Portal和Liferay DXP都是美国Liferay公司的产品。Liferay Portal是一套基于J2EE的门户解决方案。该方案使用了EJB以及JMS等技术，并可作为Web发布和共享工作区、企业协作平台、社交网络等。Liferay DXP是一套数字化体验协作平台。
Liferay Portal和Liferay DXP 存在跨站脚本漏洞。该漏洞源于程序的"_com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments"参数中用户提供的数据处理不充分而导致的。远程攻击者可以在易受攻击的网站的上下文中在用户浏览器中注入并执行任意HTML和脚本代码。以下产品及版本受到影响：Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1。
solution:Upgrade liferay dxp to a higher version than 7.0,7.0:fix_pack_13,7.0:fix_pack_14,7.0:fix_pack_24,7.0:fix_pack_25,7.0:fix_pack_26,7.0:fix_pack_27,7.0:fix_pack_28,7.0:fix_pack_3+,7.0:fix_pack_30,7.0:fix_pack_33,7.0:fix_pack_35,7.0:fix_pack_36,7.0:fix_pack_39,7.0:fix_pack_40,7.0:fix_pack_41,7.0:fix_pack_42,7.0:fix_pack_43,7.0:fix_pack_44,7.0:fix_pack_45,7.0:fix_pack_46,7.0:fix_pack_47,7.0:fix_pack_48,7.0:fix_pack_49,7.0:fix_pack_50,7.0:fix_pack_51,7.0:fix_pack_52,7.0:fix_pack_53,7.0:fix_pack_54,7.0:fix_pack_56,7.0:fix_pack_57,7.0:fix_pack_58,7.0:fix_pack_59,7.0:fix_pack_60,7.0:fix_pack_61,7.0:fix_pack_64,7.0:fix_pack_65,7.0:fix_pack_66,7.0:fix_pack_67,7.0:fix_pack_68,7.0:fix_pack_69,7.0:fix_pack_70,7.0:fix_pack_71,7.0:fix_pack_72,7.0:fix_pack_73,7.0:fix_pack_75,7.0:fix_pack_76,7.0:fix_pack_78,7.0:fix_pack_79,7.0:fix_pack_80,7.0:fix_pack_81,7.0:fix_pack_82,7.0:fix_pack_83,7.0:fix_pack_84,7.0:fix_pack_85,7.0:fix_pack_86,7.0:fix_pack_87,7.0:fix_pack_88,7.0:fix_pack_89,7.0:fix_pack_90,7.0:fix_pack_91,7.0:fix_pack_92,7.0:fix_pack_93,7.0:fix_pack_94,7.0:fix_pack_95,7.0:fix_pack_96,7.1:fix_pack_1,7.1:fix_pack_10,7.1:fix_pack_11,7.1:fix_pack_12,7.1:fix_pack_13,7.1:fix_pack_14,7.1:fix_pack_15,7.1:fix_pack_16,7.1:fix_pack_17,7.1:fix_pack_18,7.1:fix_pack_19,7.1:fix_pack_2,7.1:fix_pack_20,7.1:fix_pack_3,7.1:fix_pack_4,7.1:fix_pack_5,7.1:fix_pack_6,7.1:fix_pack_7,7.1:fix_pack_8,7.1:fix_pack_9,7.2,7.2:fix_pack_1,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8,7.2:fix_pack_9,7.3,and avoid the version 7.0,7.0:fix_pack_13,7.0:fix_pack_14,7.0:fix_pack_24,7.0:fix_pack_25,7.0:fix_pack_26,7.0:fix_pack_27,7.0:fix_pack_28,7.0:fix_pack_3+,7.0:fix_pack_30,7.0:fix_pack_33,7.0:fix_pack_35,7.0:fix_pack_36,7.0:fix_pack_39,7.0:fix_pack_40,7.0:fix_pack_41,7.0:fix_pack_42,7.0:fix_pack_43,7.0:fix_pack_44,7.0:fix_pack_45,7.0:fix_pack_46,7.0:fix_pack_47,7.0:fix_pack_48,7.0:fix_pack_49,7.0:fix_pack_50,7.0:fix_pack_51,7.0:fix_pack_52,7.0:fix_pack_53,7.0:fix_pack_54,7.0:fix_pack_56,7.0:fix_pack_57,7.0:fix_pack_58,7.0:fix_pack_59,7.0:fix_pack_60,7.0:fix_pack_61,7.0:fix_pack_64,7.0:fix_pack_65,7.0:fix_pack_66,7.0:fix_pack_67,7.0:fix_pack_68,7.0:fix_pack_69,7.0:fix_pack_70,7.0:fix_pack_71,7.0:fix_pack_72,7.0:fix_pack_73,7.0:fix_pack_75,7.0:fix_pack_76,7.0:fix_pack_78,7.0:fix_pack_79,7.0:fix_pack_80,7.0:fix_pack_81,7.0:fix_pack_82,7.0:fix_pack_83,7.0:fix_pack_84,7.0:fix_pack_85,7.0:fix_pack_86,7.0:fix_pack_87,7.0:fix_pack_88,7.0:fix_pack_89,7.0:fix_pack_90,7.0:fix_pack_91,7.0:fix_pack_92,7.0:fix_pack_93,7.0:fix_pack_94,7.0:fix_pack_95,7.0:fix_pack_96,7.1:fix_pack_1,7.1:fix_pack_10,7.1:fix_pack_11,7.1:fix_pack_12,7.1:fix_pack_13,7.1:fix_pack_14,7.1:fix_pack_15,7.1:fix_pack_16,7.1:fix_pack_17,7.1:fix_pack_18,7.1:fix_pack_19,7.1:fix_pack_2,7.1:fix_pack_20,7.1:fix_pack_3,7.1:fix_pack_4,7.1:fix_pack_5,7.1:fix_pack_6,7.1:fix_pack_7,7.1:fix_pack_8,7.1:fix_pack_9,7.2,7.2:fix_pack_1,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8,7.2:fix_pack_9,7.3; Upgrade liferay liferay_portal to a higher version than 7.3.5,and avoid the version [7.0.0,7.3.5]