CVE-2022-42130: Medium severity Liferay Digital Experience Platform vulnerability
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.5 - Upgrade
Upgrade
Liferay DXP / Dynamic Data Mapping (DDM)to a version that resolves this vulnerability.Patch Liferay DXP 7.1 before fix pack 27
Event History
Frequently Asked Questions
What is CVE-2022-42130?
CVE-2022-42130 is a vulnerability in the Dynamic Data Mapping module in Liferay Portal and Liferay DXP, which allows remote authenticated users to view and access all form entries.
What is the severity of CVE-2022-42130?
The severity of CVE-2022-42130 is medium with a CVSS score of 4.3.
Which versions of Liferay Portal and Liferay DXP are affected by CVE-2022-42130?
CVE-2022-42130 affects Liferay Portal versions 7.1.0 through 7.4.3.4 and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA.
How can remote authenticated users exploit CVE-2022-42130?
Remote authenticated users can exploit CVE-2022-42130 by viewing and accessing all form entries, compromising the confidentiality and integrity of the data.
Is there a fix available for CVE-2022-42130?
Yes, fixes are available for CVE-2022-42130. It is recommended to update to the latest version of Liferay Portal or Liferay DXP that includes the fix.