Description
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Remediation
References
Related Vulnerabilities
Oracle Application Server Other Vulnerability (CVE-2004-1369)
Envoy Proxy Uncontrolled Resource Consumption Vulnerability (CVE-2023-44487)
Jboss EAP Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-14721)
WordPress Plugin Custom Contact Forms Multiple Cross-Site Scripting Vulnerabilities (5.0.0.1)