CVE-2021-35463: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the Frontend Taglib module of Liferay Portal 7.4.0. The vulnerability, identified as CVE-2021-35463, was disclosed on August 4, 2021, and allows remote attackers to inject arbitrary web script or HTML into the management toolbar search through the keywords parameter (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a Base Score of 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML into the management toolbar search, potentially leading to unauthorized script execution in users' browsers. This could result in theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability affects Liferay Portal version 7.4.0. Users should upgrade to a patched version of the software as recommended by Liferay (Vendor Advisory).