Description
The Dynamic Data Mapping module in Liferay Portal through v7.3.6 and Liferay DXP through v7.3 incorrectly sets default permissions for site members, allowing authenticated attackers to add and duplicate forms via the UI or the API.
Remediation
References
Related Vulnerabilities
WordPress Plugin myLinksDump 'url' Parameter SQL Injection (1.2)
WordPress Plugin BuddyPress Docs Security Bypass (1.9.2)
WordPress Plugin JobSearch WP Job Board Cross-Site Scripting (1.5.4)
SharePoint CVE-2024-49068 Vulnerability (CVE-2024-49068)
Question2Answer Improper Input Validation Vulnerability (CVE-2017-12775)