CVE-2021-38267: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability was discovered in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2. The vulnerability was assigned identifier CVE-2021-38267 and was disclosed on August 9, 2021 (MITRE CVE, Liferay Security).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameters in the blog entry page. The vulnerability has been assigned a CVSS v3.1 score of 5.4 (Medium) and CVSS v2.0 score of 3.5 (Low) (NVD).

If exploited, this vulnerability could allow attackers to inject and execute malicious web scripts or HTML code in the context of other users' browsers who view the affected blog entries. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser.

The vulnerability requires an attacker to have access to create or edit blog entries in the Liferay Portal. The attack can be executed by submitting specially crafted content in the title and subtitle fields of blog entries.

The vulnerability has been fixed in Liferay Portal version 7.3.7 and Liferay DXP 7.3 fix pack 2. Users are recommended to upgrade to these or later versions to address this security issue (Liferay Security).