Lucene search

GitHub Advisory DatabaseGHSA-G6X4-57HP-J4XM

HistoryNov 15, 2022 - 12:00 p.m.

Authorization Bypass in Liferay Portal

2022-11-1512:00:16

CWE-639

GitHub Advisory Database

github.com

authorization bypass

idor vulnerability

dynamic data mapping

liferay portal

remote authenticated users

form entries.

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

49.1%

JSON

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the formInstanceRecordId parameter.

Affected configurations

Vulners

Node

com.liferay.portal\Matchrelease.portal.bom

CPENameOperatorVersion
com.liferay.portal:release.portal.bomlt7.4.3.5

CPE	Name	Operator	Version
	com.liferay.portal:release.portal.bom	lt	7.4.3.5

References

liferay.com

github.com/advisories/GHSA-g6x4-57hp-j4xm

issues.liferay.com/browse/LPE-17448

nvd.nist.gov/vuln/detail/CVE-2022-42129

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

49.1%

JSON

Related for GHSA-G6X4-57HP-J4XM