Description

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

Remediation

References

CVE-2022-42129

Related Vulnerabilities

Magento Improper Input Validation Vulnerability (CVE-2019-7899)

WordPress Plugin Dbox 3D Slider Lite SQL Injection (1.2.2)

MySQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-1492)

PHP Safedir restriction bypass vulnerabilities

WordPress Plugin YITH WooCommerce Frequently Bought Together Security Bypass (1.2.10)

Severity

Medium

Classification

CVE-2022-42129 CWE-639 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities