Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the comliferayassetlistwebportletAssetListPortlettitle parameter.
{ "cpes": [ "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*" ], "severity": "Medium" }