Description

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

Remediation

References

CVE-2022-42129

Related Vulnerabilities

WordPress Plugin Premium SEO Pack Multiple Vulnerabilities (1.8.0)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Multiple Unspecified Vulnerabilities (1.06.08)

Oracle Database Server Other Vulnerability (CVE-2003-0727)

Squid Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2213)

Phusion Passenger Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2013-4136)

Severity

Medium

Classification

CVE-2022-42129 CWE-639 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities