Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

Remediation

References

CVE-2022-42130

Related Vulnerabilities

MySQL CVE-2020-14809 Vulnerability (CVE-2020-14809)

WordPress Plugin Backup, Restore and Migrate WordPress Sites With the XCloner Cross-Site Request Forgery (4.2.152)

Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2017-15095)

WordPress 5.9.x Multiple Vulnerabilities (5.9 - 5.9.7)

WordPress Plugin Simple Download Monitor Multiple Vulnerabilities (3.9.5.1)

Severity

Medium

Classification

CVE-2022-42130 CWE-276 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities