CVE-2021-38265: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the comliferayassetlistwebportletAssetListPortlettitle parameter. The vulnerability was discovered and disclosed in August 2021, affecting specific versions of Liferay Portal (Liferay Advisory).

The vulnerability is classified as a stored cross-site scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability specifically affects the Asset module's collection page creation functionality, where input validation is insufficient for the comliferayassetlistwebportletAssetListPortlettitle parameter (NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML into the application. This can lead to potential client-side attacks where malicious scripts could be executed in users' browsers, potentially compromising user data or enabling session hijacking (NVD).

The vulnerability has been fixed in Liferay Portal version 7.3.7. Users running affected versions (7.3.4 through 7.3.6) should upgrade to the patched version to mitigate this security risk (Liferay Advisory).