What is CVE-2022-42129?

CVE-2022-42129 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2022-11-15.

How severe is CVE-2022-42129?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Liferay Digital Experience Platform

CVE-2022-42129

An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Liferay Digital_experience_platform — versions 7.3, 7.4
Liferay Liferay_portal
N/a — versions n/a

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

af854a3a-2127-422b-91ae-364da2661108 (Vendor Advisory)
cve@mitre.org (Vendor Advisory)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-42129?: CVE-2022-42129 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2022-11-15.
How severe is CVE-2022-42129?: Medium severity. CVSS v3 base score is 4.3 out of 10.