CVE:CVE-2021-29048
CNNVD:CNNVD-202105-608
Liferay Enterprise Portal是美国Liferay公司的一个应用系统。提供一个展示电子商务功能。
Liferay Enterprise Portal 存在跨站脚本漏洞。该漏洞源于程序布局模块的管理页面中对用户提供的数据处理不充分。以下产品及版本受到影响：7.3.4 ga5, 7.3.5 ga6。
solution:Upgrade liferay dxp to a higher version than 7.2,7.2:fix_pack_1,7.2:fix_pack_10,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8,7.2:fix_pack_9,7.3,and avoid the version 7.2,7.2:fix_pack_1,7.2:fix_pack_10,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8,7.2:fix_pack_9,7.3; Upgrade liferay liferay_portal to a higher version than 7.3.4,7.3.5,and avoid the version 7.3.4,7.3.5