Information disclosure in Liferay Enterprise Portal - CVE-2022-42129
Published: October 24, 2022
Vulnerability identifier: #VU68605
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-42129
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an insecure direct object reference (IDOR) issue in the Dynamic Data Mapping module in the "formInstanceRecordId" parameter. A remote user can view and access form entries.
Affected software
Liferay Enterprise Portal
How to mitigate CVE-2022-42129
Install updates from vendor's website.
Liferay Enterprise Portal - update to 7.4.3.5 ga5