Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Unauthorized users can view forms and form entries

Affects versions

Fix versions

7.0 Fix Pack Version

94

7.1 Fix Pack Version

19

7.2 Fix Pack Version

6

7.3 Fix Pack Version

None

7.4 Fix Pack Version

None

CVE IDs

CVSS Base Score

CVSS Vector String

Labels

Description

Forms in Liferay DXP 7.0, 7.1 and 7.2 does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms in the site and the form entries via the forms section in site administration.

Activity

Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Priority

Components

Zendesk Support

Created June 9, 2020 at 10:49 AM
Updated August 2, 2021 at 12:15 AM
Resolved June 29, 2020 at 3:45 AM