CVEvulnerability

CVE-2022-38512

6.5 MEDIUM Published 2022-09-22 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-09-22
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-862

Description

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Affected configurations

• liferay dxp 7.4 • liferay liferay portal (>= 7.4.3.12 <= 7.4.3.36)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References