CVE-2022-42130
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
Risk Assessment
The organization is at risk of sensitive data leakage because authenticated users can access form entries they should not have permission to view.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.3.5 or later, and for Liferay DXP apply the appropriate fix pack or update as indicated in the CVE description.
Original NVD description (English source)
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.