CVE-2021-33336

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.

• CWE-79

• https://issues.liferay.com/browse/LPE-17078Patch, Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-nameRelease Notes, Vendor Advisory
• https://issues.liferay.com/browse/LPE-17078Patch, Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-nameRelease Notes, Vendor Advisory

Published

Aug 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33330Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 befo…4.3
• CVE-2021-33331Open redirect vulnerability in the Notifications module in L…6.1
• CVE-2021-33332Cross-site scripting (XSS) vulnerability in the Portlet Conf…6.1
• CVE-2021-33333The Portal Workflow module in Liferay Portal 7.3.2 and earli…6.3
• CVE-2021-33334The Dynamic Data Mapping module in Liferay Portal 7.0.0 thro…4.3
• CVE-2021-33335Privilege escalation vulnerability in Liferay Portal 7.0.3 t…7.2
• CVE-2021-33337Cross-site scripting (XSS) vulnerability in the Document Lib…6.1
• CVE-2021-33338The Layout module in Liferay Portal 7.1.0 through 7.3.2, and…7.5
• CVE-2021-33339Cross-site scripting (XSS) vulnerability in the Fragment mod…4.8
• CVE-2021-33346There is an arbitrary password modification vulnerability in…9.8
• CVE-2021-33347An issue was discovered in JPress v3.3.0 and below. There ar…5.4
• CVE-2021-33348An issue was discovered in JFinal framework v4.9.10 and belo…6.1