LSV-955: Unauthorized access to DDL Data Definition

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.1 DXP (7.1.10)
• Fix Version/s: 7.1.x EE
• Component/s: Dynamic Data Lists, Dynamic Data Mapping, Forms, Security Vulnerability
• Labels:
  • liferay-fixpack-dxp-17-7210
  • liferay-fixpack-dxp-27-7110
  • liferay-fixpack-dxp-3-7310
• CVSS Base Score: 5.3
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• 7.1 Fix Pack Version: 27

The Dynamic Data List module in Liferay DXP grants guest users view permission to data definition by default, which allows remote attackers to view any data definition via the UI or API.