CVE-2021-29045: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in Liferay Portal versions 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1. The vulnerability exists in the Redirect module's redirection administration page, specifically affecting the comliferayredirectwebinternalportletRedirectPortletdestinationURL parameter (NVD, CVE).

The vulnerability has been assigned CVE-2021-29045 and received a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it scored 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79, which refers to Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through the affected parameter. This could potentially lead to the execution of malicious scripts in users' browsers, compromising the confidentiality and integrity of user data (NVD).

Users of affected versions should upgrade to Liferay DXP 7.3 fix pack 1 or later, or update their Liferay Portal installation to a version newer than 7.3.5 (Liferay Advisory).