CVE-2021-29048: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the comliferaylayoutadminwebportletGroupPagesPortletname parameter (CVE Details).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue affecting the Layout module's page administration functionality. The vulnerability exists in the parameter handling of comliferaylayoutadminwebportletGroupPagesPortletname within the page administration interface. The CVSS v3.1 score is 6.1 (MEDIUM), while the CVSS v2.0 score is 4.3 (MEDIUM) (NVD).

If exploited, this vulnerability allows remote attackers to inject malicious web scripts or HTML code into the page administration interface. This could potentially lead to unauthorized access to user data, session hijacking, or other malicious activities typically associated with XSS attacks (CVE Details).

Users should upgrade to Liferay DXP 7.2 fix pack 11 or later, or Liferay DXP 7.3 fix pack 1 or later. For Liferay Portal users, versions after 7.3.5 contain the fix for this vulnerability (CVE Details).