CVE-2021-33336: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter (NVD, Liferay Portal).

The vulnerability exists in the journal module where the _com_liferay_journal_web_portlet_JournalPortlet_name parameter is not properly sanitized, allowing for injection of malicious web script or HTML. This is classified as a stored XSS vulnerability, which means the malicious script is permanently stored on the target servers (Liferay Portal).

The vulnerability allows remote attackers to inject and execute arbitrary web script or HTML in the context of other users' browsers who access the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users (NVD).

The vulnerability has been fixed in Liferay Portal version 7.3.4. Users of affected versions should upgrade to this version or later to mitigate the vulnerability (Liferay Portal).