CVE-2021-38264

{"id": "CVE-2021-38264", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-03-03T00:15:07.980", "references": [{"url": "http://liferay.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38264-reflected-xss-with-keywords-in-search", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463."}, {"lang": "es", "value": "Una vulnerabilidad de scripting cruzado (XSS) en el m\u00f3dulo Frontend Taglib en Liferay Portal 7.4.0 y 7.4.1 permite a los atacantes remotos inyectar script web o HTML arbitrario en la b\u00fasqueda de la barra de herramientas de gesti\u00f3n a trav\u00e9s del par\u00e1metro `keywords`. Este problema est\u00e1 causado por una correcci\u00f3n incompleta en CVE-2021-35463"}], "lastModified": "2022-06-05T03:51:10.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D77AE89B-3769-4AEC-AF7B-00AAE3F345F9"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:7.4.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EBEF105-7297-44E3-B458-944861A941C2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}