CVE-2022-42129

2022-11-1500:00:00

mitre

www.cve.org

insecure direct object reference

dynamic data mapping

liferay portal

liferay dxp

remote authenticated users

form entries

forminstancerecordid parameter

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.1%

JSON

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the formInstanceRecordId parameter.