CVE:CVE-2021-33328
CNNVD:CNNVD-202108-349
Liferay Portal和Liferay DXP都是美国Liferay公司的产品。Liferay Portal是一套基于J2EE的门户解决方案。该方案使用了EJB以及JMS等技术，并可作为Web发布和共享工作区、企业协作平台、社交网络等。Liferay DXP是一套数字化体验协作平台。
Liferay Portal和Liferay DXP存在安全漏洞，远程攻击者可以通过_com_Liferay_journal_web_portlet_JournalPortlet_name或_com_Liferay_document_library_web_portlet_DLAdminPortlet_name参数注入任意web脚本或HTML代码。
solution:Upgrade liferay dxp to a higher version than 7.0,7.0:fix_pack_13,7.0:fix_pack_14,7.0:fix_pack_24,7.0:fix_pack_25,7.0:fix_pack_26,7.0:fix_pack_27,7.0:fix_pack_28,7.0:fix_pack_3+,7.0:fix_pack_30,7.0:fix_pack_33,7.0:fix_pack_35,7.0:fix_pack_36,7.0:fix_pack_39,7.0:fix_pack_40,7.0:fix_pack_41,7.0:fix_pack_42,7.0:fix_pack_43,7.0:fix_pack_44,7.0:fix_pack_45,7.0:fix_pack_46,7.0:fix_pack_47,7.0:fix_pack_48,7.0:fix_pack_49,7.0:fix_pack_50,7.0:fix_pack_51,7.0:fix_pack_52,7.0:fix_pack_53,7.0:fix_pack_54,7.0:fix_pack_56,7.0:fix_pack_57,7.0:fix_pack_58,7.0:fix_pack_59,7.0:fix_pack_60,7.0:fix_pack_61,7.0:fix_pack_64,7.0:fix_pack_65,7.0:fix_pack_66,7.0:fix_pack_67,7.0:fix_pack_68,7.0:fix_pack_69,7.0:fix_pack_70,7.0:fix_pack_71,7.0:fix_pack_72,7.0:fix_pack_73,7.0:fix_pack_75,7.0:fix_pack_76,7.0:fix_pack_78,7.0:fix_pack_79,7.0:fix_pack_80,7.0:fix_pack_81,7.0:fix_pack_82,7.0:fix_pack_83,7.0:fix_pack_84,7.0:fix_pack_85,7.0:fix_pack_86,7.0:fix_pack_87,7.0:fix_pack_88,7.0:fix_pack_89,7.0:fix_pack_90,7.0:fix_pack_91,7.0:fix_pack_92,7.0:fix_pack_93,7.0:fix_pack_94,7.0:fix_pack_95,7.1,7.1:fix_pack_1,7.1:fix_pack_10,7.1:fix_pack_11,7.1:fix_pack_12,7.1:fix_pack_13,7.1:fix_pack_14,7.1:fix_pack_15,7.1:fix_pack_16,7.1:fix_pack_17,7.1:fix_pack_18,7.1:fix_pack_19,7.1:fix_pack_2,7.1:fix_pack_3,7.1:fix_pack_4,7.1:fix_pack_5,7.1:fix_pack_6,7.1:fix_pack_7,7.1:fix_pack_8,7.1:fix_pack_9,7.2,7.2:fix_pack_1,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8,and avoid the version 7.0,7.0:fix_pack_13,7.0:fix_pack_14,7.0:fix_pack_24,7.0:fix_pack_25,7.0:fix_pack_26,7.0:fix_pack_27,7.0:fix_pack_28,7.0:fix_pack_3+,7.0:fix_pack_30,7.0:fix_pack_33,7.0:fix_pack_35,7.0:fix_pack_36,7.0:fix_pack_39,7.0:fix_pack_40,7.0:fix_pack_41,7.0:fix_pack_42,7.0:fix_pack_43,7.0:fix_pack_44,7.0:fix_pack_45,7.0:fix_pack_46,7.0:fix_pack_47,7.0:fix_pack_48,7.0:fix_pack_49,7.0:fix_pack_50,7.0:fix_pack_51,7.0:fix_pack_52,7.0:fix_pack_53,7.0:fix_pack_54,7.0:fix_pack_56,7.0:fix_pack_57,7.0:fix_pack_58,7.0:fix_pack_59,7.0:fix_pack_60,7.0:fix_pack_61,7.0:fix_pack_64,7.0:fix_pack_65,7.0:fix_pack_66,7.0:fix_pack_67,7.0:fix_pack_68,7.0:fix_pack_69,7.0:fix_pack_70,7.0:fix_pack_71,7.0:fix_pack_72,7.0:fix_pack_73,7.0:fix_pack_75,7.0:fix_pack_76,7.0:fix_pack_78,7.0:fix_pack_79,7.0:fix_pack_80,7.0:fix_pack_81,7.0:fix_pack_82,7.0:fix_pack_83,7.0:fix_pack_84,7.0:fix_pack_85,7.0:fix_pack_86,7.0:fix_pack_87,7.0:fix_pack_88,7.0:fix_pack_89,7.0:fix_pack_90,7.0:fix_pack_91,7.0:fix_pack_92,7.0:fix_pack_93,7.0:fix_pack_94,7.0:fix_pack_95,7.1,7.1:fix_pack_1,7.1:fix_pack_10,7.1:fix_pack_11,7.1:fix_pack_12,7.1:fix_pack_13,7.1:fix_pack_14,7.1:fix_pack_15,7.1:fix_pack_16,7.1:fix_pack_17,7.1:fix_pack_18,7.1:fix_pack_19,7.1:fix_pack_2,7.1:fix_pack_3,7.1:fix_pack_4,7.1:fix_pack_5,7.1:fix_pack_6,7.1:fix_pack_7,7.1:fix_pack_8,7.1:fix_pack_9,7.2,7.2:fix_pack_1,7.2:fix_pack_2,7.2:fix_pack_3,7.2:fix_pack_4,7.2:fix_pack_5,7.2:fix_pack_6,7.2:fix_pack_7,7.2:fix_pack_8; Upgrade liferay liferay_portal to a higher version than 7.3.5,and avoid the version [7.0.0,7.3.5)