CVE-2021-36737

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Portals	org.apache.portals.pluto:PortletV3Demo 3.0.0; org.apache.portals.pluto:PortletV3Demo 3.0.1; org.apache.portals.pluto.demo:v3-demo-portlet 3.1.0

References

https://lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25Mailing List, Vendor Advisory
https://lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25Mailing List, Vendor Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367386.1The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. CVE-2021-367396.1The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting CVE-2021-36747.8A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted val CVE-2021-367406.5Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST reque CVE-2021-367418.8An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1 CVE-2021-367427.8A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.CVE-2021-367447.8Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit CVE-2021-367459.8A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers CVE-2021-367465.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-367475.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-367487.5A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a CVE-2021-367496.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut