CVE-2021-33337

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

• CWE-79

• https://issues.liferay.com/browse/LPE-17101Issue Tracking, Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-mediaVendor Advisory
• https://issues.liferay.com/browse/LPE-17101Issue Tracking, Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-mediaVendor Advisory

Published

Aug 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33331Open redirect vulnerability in the Notifications module in L…6.1
• CVE-2021-33332Cross-site scripting (XSS) vulnerability in the Portlet Conf…6.1
• CVE-2021-33333The Portal Workflow module in Liferay Portal 7.3.2 and earli…6.3
• CVE-2021-33334The Dynamic Data Mapping module in Liferay Portal 7.0.0 thro…4.3
• CVE-2021-33335Privilege escalation vulnerability in Liferay Portal 7.0.3 t…7.2
• CVE-2021-33336Cross-site scripting (XSS) vulnerability in the Journal modu…5.4
• CVE-2021-33338The Layout module in Liferay Portal 7.1.0 through 7.3.2, and…7.5
• CVE-2021-33339Cross-site scripting (XSS) vulnerability in the Fragment mod…4.8
• CVE-2021-33346There is an arbitrary password modification vulnerability in…9.8
• CVE-2021-33347An issue was discovered in JPress v3.3.0 and below. There ar…5.4
• CVE-2021-33348An issue was discovered in JFinal framework v4.9.10 and belo…6.1
• CVE-2021-33351Cross Site Scripting Vulnerability in Wyomind Help Desk Mage…9