CVE-2022-38512

Published: Sep 22, 2022Modified: May 27, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Affected (31)

Products: Liferay: Dxp, Liferay Portal

Liferay

2 products

Dxp

Liferay Portal

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Liferay Dxp	Version 7.4 update_10
Liferay Dxp	Version 7.4 update_11
Liferay Dxp	Version 7.4 update_12
Liferay Dxp	Version 7.4 update_13
Liferay Dxp	Version 7.4 update_14
Liferay Dxp	Version 7.4 update_15
Liferay Dxp	Version 7.4 update_16
Liferay Dxp	Version 7.4 update_17
Liferay Dxp	Version 7.4 update_18
Liferay Dxp	Version 7.4 update_19
Liferay Dxp	Version 7.4 update_20
Liferay Dxp	Version 7.4 update_21
Liferay Dxp	Version 7.4 update_22
Liferay Dxp	Version 7.4 update_23
Liferay Dxp	Version 7.4 update_24
Liferay Dxp	Version 7.4 update_25
Liferay Dxp	Version 7.4 update_26
Liferay Dxp	Version 7.4 update_27
Liferay Dxp	Version 7.4 update_28
Liferay Dxp	Version 7.4 update_29
Liferay Dxp	Version 7.4 update_30
Liferay Dxp	Version 7.4 update_31
Liferay Dxp	Version 7.4 update_32
Liferay Dxp	Version 7.4 update_33
Liferay Dxp	Version 7.4 update_34
Liferay Dxp	Version 7.4 update_35
Liferay Dxp	Version 7.4 update_36
Liferay Dxp	Version 7.4 update_3
Liferay Dxp	Version 7.4 update_8
Liferay Dxp	Version 7.4 update_9
Liferay Liferay Portal	From 7.4.3.12 to 7.4.3.36