Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

Remediation

References

http://liferay.com

https://issues.liferay.com/browse/LPE-17447

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130

Related Vulnerabilities

CVE-2019-10083 Vulnerability in maven package org.apache.nifi:nifi-framework

CVE-2022-37865 Vulnerability in maven package org.apache.ivy:ivy

CVE-2023-47112 Vulnerability in maven package org.rundeck:rundeck

CVE-2012-5887 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2021-33900 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.parent

Severity

Medium

Classification

CWE-276 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory