CVE-2021-29052 | BDVDB-2026-153921 Detail

Description#

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159

Exploit#

No public exploit known

History#

Version 12021-05-17Record published in the CVE List.
Version 22026-07-09Most recent update recorded in the CVE List.