CVE-2022-42129

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://liferay.com	Vendor Advisory
https://issues.liferay.com/browse/LPE-17448	Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liferay:digital_experience_platform:7.3:-::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:-::::::
	cpe:2.3:a:liferay:liferay_portal::::::::

History

No history.

Information

Published : 2022-11-15 02:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-42129

Mitre link : CVE-2022-42129

CVE.ORG link : CVE-2022-42129

JSON object : View

Products Affected

liferay

liferay_portal
digital_experience_platform

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2022-42129", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-15T02:15:11.590", "references": [{"url": "http://liferay.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://issues.liferay.com/browse/LPE-17448", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter."}, {"lang": "es", "value": "Una vulnerabilidad de Insecure Direct Object Reference (IDOR) en el m\u00f3dulo Dynamic Data Mapping en Liferay Portal 7.3.2 hasta 7.4.3.4, y Liferay DXP 7.3 antes de la actualizaci\u00f3n 4, y 7.4 GA permite a usuarios remotos autenticados ver y acceder a entradas de formulario a trav\u00e9s del par\u00e1metro `formInstanceRecordId`."}], "lastModified": "2022-11-18T16:00:17.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F6A98ED-E694-4F39-95D0-C152BD1EC115"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96E84DBC-C740-4E23-8D1D-83C8AE49813E"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C01C7D38-BC12-4921-ADE6-799945887D66", "versionEndExcluding": "7.4.3.5", "versionStartIncluding": "7.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}