CVE-2022-42130

The Dynamic Data Mapping (DDM) module in Liferay Portal 7.1.0 through 7.4.3.4 and several Liferay DXP versions fails to properly verify permissions when accessing form entries. This flaw allows a remote authenticated user to view and access any form entry stored in the system, regardless of intended access controls [1].

An attacker with valid credentials (remote authenticated user) can exploit this vulnerability by directly requesting form entry endpoints that lack proper authorization checks. No special privileges or network position beyond standard user access is required, as the missing permission check applies globally to all form entries.

The impact is unauthorized disclosure of potentially sensitive data submitted through forms, including personal, financial, or business information. This could lead to privacy violations, data leaks, or compliance issues depending on the nature of the data collected.

Liferay has addressed the issue in fix packs and updates for the affected versions: DXP 7.1 fix pack 27, 7.2 fix pack 19, 7.3 update 4, and Portal 7.4.3.5+. Users should apply the latest updates to mitigate the risk [1].