BIT-liferay-2022-42129

vendorUSosv

view advisory published 2024-01-31Licence: per source

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-42129US	medium4.3	0.66% (51st)	—	2022-11-15
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://issues.liferay.com/browse/LPE-17448WEB
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan