CVE-2021-38267: 
Java vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability was discovered in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2. The vulnerability was assigned identifier CVE-2021-38267 and was disclosed on August 9, 2021 (MITRE CVE, Liferay Security).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via the comliferayblogswebportletBlogsAdminPortlettitle and comliferayblogswebportletBlogsAdminPortletsubtitle parameters in the blog entry page. The vulnerability has been assigned a CVSS v3.1 score of 5.4 (Medium) and CVSS v2.0 score of 3.5 (Low) (NVD).

If exploited, this vulnerability could allow attackers to inject and execute malicious web scripts or HTML code in the context of other users' browsers who view the affected blog entries. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser.

The vulnerability has been fixed in Liferay Portal version 7.3.7 and Liferay DXP 7.3 fix pack 2. Users are recommended to upgrade to these or later versions to address this security issue (Liferay Security).