CVE-2021-38268

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10…

published March 2, 2022

CVSS
—
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00777 · 55.3th percentile
Published
2022-03-02T18:45Z
EPSS history
Timeline
  • 02 MAR 18:45Z
    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10…
    cvelistv5