CVE-2022-38512: Liferay Dxp

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Affected products

• Liferay Dxp: version 7.4 only
• Liferay Liferay Portal: from 7.4.3.12, up to and including 7.4.3.36

Published 2022-09-22. Last modified 2026-07-09.