GHSA-g6x4-57hp-j4xm

Suggest an improvement
Source
https://github.com/advisories/GHSA-g6x4-57hp-j4xm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-g6x4-57hp-j4xm/GHSA-g6x4-57hp-j4xm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g6x4-57hp-j4xm
Aliases
Published
2022-11-15T12:00:16Z
Modified
2023-12-06T01:02:40.171431Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Authorization Bypass in Liferay Portal
Details

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the formInstanceRecordId parameter.

References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name
com.liferay.portal:release.portal.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.3.2
Fixed
7.4.3.5

Affected versions

7.*

7.3.2
7.3.2-1
7.3.3
7.3.3-1
7.3.4
7.3.5
7.3.6
7.3.7
7.4.0
7.4.1
7.4.1-1
7.4.2
7.4.2-1
7.4.3.4