Description
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Remediation
References
Related Vulnerabilities
Liferay Portal External Control of System or Configuration Setting Vulnerability (CVE-2025-43792)
WordPress Plugin Gallery-Flagallery Photo Portfolio 'flagshow.php' Cross-Site Scripting (1.57)
Oracle JRE CVE-2013-2442 Vulnerability (CVE-2013-2442)
MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2006-0369)
WordPress Plugin Contact Form Unspecified Vulnerability (1.2)