The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
During installation, installed file permissions are set to allow anyone to modify those files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_experience_platform | Liferay | 7.1 (including) | 7.1 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_1 (including) | 7.1-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_10 (including) | 7.1-fix_pack_10 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_11 (including) | 7.1-fix_pack_11 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_12 (including) | 7.1-fix_pack_12 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_13 (including) | 7.1-fix_pack_13 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_14 (including) | 7.1-fix_pack_14 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_15 (including) | 7.1-fix_pack_15 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_16 (including) | 7.1-fix_pack_16 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_17 (including) | 7.1-fix_pack_17 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_18 (including) | 7.1-fix_pack_18 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_19 (including) | 7.1-fix_pack_19 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_2 (including) | 7.1-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_20 (including) | 7.1-fix_pack_20 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_21 (including) | 7.1-fix_pack_21 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_22 (including) | 7.1-fix_pack_22 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_23 (including) | 7.1-fix_pack_23 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_24 (including) | 7.1-fix_pack_24 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_25 (including) | 7.1-fix_pack_25 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_26 (including) | 7.1-fix_pack_26 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_3 (including) | 7.1-fix_pack_3 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_4 (including) | 7.1-fix_pack_4 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_5 (including) | 7.1-fix_pack_5 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_6 (including) | 7.1-fix_pack_6 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_7 (including) | 7.1-fix_pack_7 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_8 (including) | 7.1-fix_pack_8 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_9 (including) | 7.1-fix_pack_9 (including) |
| Digital_experience_platform | Liferay | 7.2 (including) | 7.2 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_1 (including) | 7.2-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_10 (including) | 7.2-fix_pack_10 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_11 (including) | 7.2-fix_pack_11 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_12 (including) | 7.2-fix_pack_12 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_13 (including) | 7.2-fix_pack_13 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_14 (including) | 7.2-fix_pack_14 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_15 (including) | 7.2-fix_pack_15 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_16 (including) | 7.2-fix_pack_16 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_2 (including) | 7.2-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_3 (including) | 7.2-fix_pack_3 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_4 (including) | 7.2-fix_pack_4 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_5 (including) | 7.2-fix_pack_5 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_6 (including) | 7.2-fix_pack_6 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_7 (including) | 7.2-fix_pack_7 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_8 (including) | 7.2-fix_pack_8 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_9 (including) | 7.2-fix_pack_9 (including) |
| Digital_experience_platform | Liferay | 7.3 (including) | 7.3 (including) |
| Digital_experience_platform | Liferay | 7.4 (including) | 7.4 (including) |
| Liferay_portal | Liferay | 7.1.0 (including) | 7.4.3.5 (excluding) |