Description

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.

Remediation

References

CVE-2021-33334

Related Vulnerabilities

WordPress Plugin Taxonomy Images Multiple Unspecified Vulnerabilities (0.6)

Jetty Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-26048)

concrete5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7725)

WordPress Plugin Aspose Importer & Exporter Arbitrary File Download (2.0)

TYPO3 Improper Input Validation Vulnerability (CVE-2012-1608)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-276 CVE-2021-33334