Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

Remediation

References

CVE-2022-42130

Related Vulnerabilities

Oracle JRE CVE-2017-10274 Vulnerability (CVE-2017-10274)

Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2022-42129)

Oracle HTTP Server Other Vulnerability (CVE-2002-0656)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1754)

Oracle Database Server Other Vulnerability (CVE-2005-3440)

Severity

Medium

Classification

CVE-2022-42130 CWE-276 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities