GHSA-mxvq-cv4x-p3jw

ghsaUSosv

Incorrect Default Permissions in Liferay Portal

view advisory published 2022-11-15Licence: CC-BY-4.0

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-42130US	medium4.3OT elevated	0.66% (51st)	—	2022-11-15
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not pr…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://issues.liferay.com/browse/LPE-17447WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-42130ADVISORY
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan