CVE-2022-38512

MediumCVSS 6.5

Published: 22/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation. This allows attackers to download a web content page's XLIFF translation file via crafted URL.

Risk Assessment

The risk involves unauthorized access to web content that may contain sensitive information, and potential data leakage through downloading translation files.

Recommendation

It is recommended to immediately update Liferay Portal to version 7.4.3.37 or later, and Liferay DXP 7.4 to update 37 or later, and implement access controls for the translation module.

Original NVD description (English source)

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.