Non-encrypted confidential information In com.liferay.portal:release.dxp.bom
Description
Liferay Portal and Liferay DXP autosaves form data for other users to see The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.1.10.fp19, 7.2.10.fp7 | ||
maven | 3.0.23 |
Aliases
1. 2. 3. 4.
References
1. 2.