The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4…
Priority LOW 30CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-862 and CWE-269.
Summary
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00683 52nd percentileScored 2026-11-07
Fix Fixed com.liferay:com.liferay.translation.web (Maven): 2.0.58com.liferay.portal:release.dxp.bom (Maven): 7.4.13.u37
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.liferay:com.liferay.translation.web (Maven) | before 2.0.58 | 2.0.58 | Patch available | GHSA-h9ww-wjg4-jvvg |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.4.13.u8 to before 7.4.13.u37 | 7.4.13.u37 | Patch available | GHSA-h9ww-wjg4-jvvg |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.liferay:com.liferay.translation.web (Maven) Vendor— Affected before 2.0.58 Fixed in 2.0.58 Patch available GHSA-h9ww-wjg4-jvvg
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.4.13.u8 to before 7.4.13.u37 Fixed in 7.4.13.u37 Patch available GHSA-h9ww-wjg4-jvvg
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:* | 7.4 update_10 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:* | 7.4 update_11 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:* | 7.4 update_12 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:* | 7.4 update_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:* | 7.4 update_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:* | 7.4 update_15 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:* | 7.4 update_16 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:* | 7.4 update_17 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:* | 7.4 update_18 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:* | 7.4 update_19 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:* Versions 7.4 update_10 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:* Versions 7.4 update_11 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:* Versions 7.4 update_12 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:* Versions 7.4 update_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:* Versions 7.4 update_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:* Versions 7.4 update_15 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:* Versions 7.4 update_16 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:* Versions 7.4 update_17 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:* Versions 7.4 update_18 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:* Versions 7.4 update_19 Vulnerable ·Liferay
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:* | 7.4 update_20 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:* | 7.4 update_21 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:* | 7.4 update_22 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:* | 7.4 update_23 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:* | 7.4 update_24 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:* | 7.4 update_25 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:* | 7.4 update_26 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:* | 7.4 update_27 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:* | 7.4 update_28 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:* | 7.4 update_29 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:* | 7.4 update_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:* | 7.4 update_30 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:* | 7.4 update_31 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:* | 7.4 update_32 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:* | 7.4 update_33 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:* | 7.4 update_34 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:* | 7.4 update_35 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:* | 7.4 update_36 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:* | 7.4 update_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:* | 7.4 update_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* | 7.4.3.12 – 7.4.3.36 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:* Versions 7.4 update_20 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:* Versions 7.4 update_21 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:* Versions 7.4 update_22 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:* Versions 7.4 update_23 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:* Versions 7.4 update_24 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:* Versions 7.4 update_25 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:* Versions 7.4 update_26 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:* Versions 7.4 update_27 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:* Versions 7.4 update_28 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:* Versions 7.4 update_29 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:* Versions 7.4 update_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:* Versions 7.4 update_30 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:* Versions 7.4 update_31 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:* Versions 7.4 update_32 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:* Versions 7.4 update_33 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:* Versions 7.4 update_34 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:* Versions 7.4 update_35 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:* Versions 7.4 update_36 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:* Versions 7.4 update_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:* Versions 7.4 update_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.3.12 – 7.4.3.36 Vulnerable ·Liferay
Remediation
- Fix · GHSA-h9ww-wjg4-jvvg com.liferay:com.liferay.translation.web (Maven) Fixed in 2.0.58 Advisory →
- Fix · GHSA-h9ww-wjg4-jvvg com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.4.13.u37 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-38512
- 2026-10-03 Alias added: GHSA-h9ww-wjg4-jvvg
References
Advisory 2
Other 6
- https://github.com/liferay/liferay-portal/commit/1934094578ddcd2c1f3d37593b493d3991a6a20f
- https://github.com/liferay/liferay-portal/commit/48fd5698fc1935a90e9c5013c328dbc369ba353d
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-17610
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-38512?p_r_p_assetEntryId=121612585&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612585%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
- http://liferay.com
More Liferay Dxp vulnerabilities
- TI-2022-18349 A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic… CVSS 3.1MEDIUM 5.4
- TI-2022-18348 A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload… CVSS 3.1MEDIUM 5.4
- TI-2022-20404 A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and… CVSS 3.1CRITICAL 9.8
- TI-2022-20402 A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through… CVSS 3.1CRITICAL 9.8
- TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
- TI-2024-16596 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
Sources
- CVE-2022-38512 · CVE Program
- CVE-2022-38512 · NVD
- FIRST EPSS
- GHSA-h9ww-wjg4-jvvg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences