Description
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
Remediation
References
http://liferay.com
https://issues.liferay.com/browse/LPE-17448
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129
Related Vulnerabilities
CVE-2019-10080 Vulnerability in maven package org.apache.nifi:nifi-commons
CVE-2023-29199 Vulnerability in npm package vm2
CVE-2023-33950 Vulnerability in maven package com.liferay.portal:release.portal.bom
CVE-2020-2252 Vulnerability in maven package org.jenkins-ci.plugins:mailer
CVE-2023-46652 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation