Lucene search

GoogleOSV:GHSA-G6X4-57HP-J4XM

HistoryNov 15, 2022 - 12:00 p.m.

Authorization Bypass in Liferay Portal

2022-11-1512:00:16

Google

osv.dev

authorization bypass

insecure direct object reference

vulnerability

liferay portal

dynamic data mapping

remote authenticated users

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

49.1%

JSON

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the formInstanceRecordId parameter.

CPENameOperatorVersion
com.liferay.portal:release.portal.bomeq7.4.0
com.liferay.portal:release.portal.bomeq7.4.2
com.liferay.portal:release.portal.bomeq7.3.3
com.liferay.portal:release.portal.bomeq7.3.2
com.liferay.portal:release.portal.bomeq7.4.2-1
com.liferay.portal:release.portal.bomeq7.3.7
com.liferay.portal:release.portal.bomeq7.4.1
com.liferay.portal:release.portal.bomeq7.3.4
com.liferay.portal:release.portal.bomeq7.3.3-1
com.liferay.portal:release.portal.bomeq7.4.1-1

Name	Operator	Version
com.liferay.portal:release.portal.bom	eq	7.4.0
com.liferay.portal:release.portal.bom	eq	7.4.2
com.liferay.portal:release.portal.bom	eq	7.3.3
com.liferay.portal:release.portal.bom	eq	7.3.2
com.liferay.portal:release.portal.bom	eq	7.4.2-1
com.liferay.portal:release.portal.bom	eq	7.3.7
com.liferay.portal:release.portal.bom	eq	7.4.1
com.liferay.portal:release.portal.bom	eq	7.3.4
com.liferay.portal:release.portal.bom	eq	7.3.3-1
com.liferay.portal:release.portal.bom	eq	7.4.1-1

Rows per page:

1-10 of 141

References

liferay.com

issues.liferay.com/browse/LPE-17448

nvd.nist.gov/vuln/detail/CVE-2022-42129

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

49.1%

JSON

Related for OSV:GHSA-G6X4-57HP-J4XM