CVE-2022-42130

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2022-11-15

Last modified

2026-07-09

Weaknesses

CWE-276

Affected products

• Digital Experience Platform (Liferay)
• Liferay Portal (Liferay)

References

• https://issues.liferay.com/browse/LPE-17447
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130