CVE-2021-29046: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability exists in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. The vulnerability was discovered and disclosed in March 2021, with the NVD publishing date of May 17, 2021. The affected systems include Liferay Portal version 7.3.5 and Liferay DXP version 7.3 prior to fix pack 1 (NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via the comliferayassetcategoriesadminwebportletAssetCategoriesAdminPortlet_title parameter. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and a CVSS v2.0 base score of 4.3 (Medium). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability could allow remote attackers to inject malicious web scripts or HTML content through the asset category selector input field. This could potentially lead to the execution of unauthorized scripts in users' browsers, potentially compromising confidentiality and integrity of user data (NVD).

Liferay has addressed this vulnerability in fix pack 1 for Liferay DXP 7.3. Users of affected versions should upgrade to the patched version to mitigate the risk (Liferay Advisory).