CVE-2022-42129
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
Risk Assessment
The organization is at risk of unauthorized access to sensitive data stored in forms, potentially leading to information disclosure and privacy breaches.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.3.5 or later, and Liferay DXP to version 7.3 update 4 or 7.4 GA with the appropriate patch.
Original NVD description (English source)
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.