Vulnerability Details CVE-2022-42129
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 49.8%
CVSS Severity
CVSS v3 Score 4.3
References
- https://issues.liferay.com/browse/LPE-17448
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129
- http://liferay.com
- https://issues.liferay.com/browse/LPE-17448
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129
Products affected by CVE-2022-42129
-
cpe:2.3:a:liferay:digital_experience_platform:7.3
-
cpe:2.3:a:liferay:digital_experience_platform:7.4