Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

Remediation

References

CVE-2022-42130

Related Vulnerabilities

Oracle Database Server Other Vulnerability (CVE-2005-3443)

WordPress 4.5.x Directory Traversal (4.5 - 4.5.31)

WordPress Plugin Brizy-Page Builder Security Bypass (2.4.44)

Perl Out-of-bounds Read Vulnerability (CVE-2018-18313)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9407)

Severity

Medium

Classification

CVE-2022-42130 CWE-276 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities