GitHub Advisoryadvisory · Maven

GHSA-g6x4-57hp-j4xm Authorization Bypass in Liferay Portal

MEDIUM Published 2022-11-15 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-42129
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639
Reviewed
2022-11-21

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.2, < 7.4.3.5 → fixed in 7.4.3.5

Description

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

Related

Alias · CVE (1)

  • CVE-2022-42129 An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References