Liferay · Liferay Portal · CVE-2021-38269
**Name of the Vulnerable Software and Affected Versions**
Liferay Portal versions 7.1.0 through 7.3.6 and 7.4.0
Liferay DXP versions 7.1.0 through 7.1 before fix pack 23
Liferay DXP versions 7.2.0 through 7.2 before fix pack 13
Liferay DXP versions 7.3.0 through 7.3 before fix pack 2
**Description**
A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command. This could potentially lead to unauthorized actions on the affected system.
**Recommendations**
For Liferay Portal versions 7.1.0 through 7.3.6 and 7.4.0, update to a version outside of the affected range.
For Liferay DXP version 7.1, apply fix pack 23 or later.
For Liferay DXP version 7.2, apply fix pack 13 or later.
For Liferay DXP version 7.3, apply fix pack 2 or later.