CVE-2022-38512 Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module

What is CVE-2022-38512?

CVE-2022-38512 is a medium-severity missing authorization vulnerability in Liferay Liferay Portal, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Weakness: CWE-862

Which versions are affected by CVE-2022-38512?

4 open source packages ship an affected version, including com.liferay.portal:release.dxp.bom and com.liferay:com.liferay.translation.web. It affects 2 products.

Products include Liferay Dxp, Liferay Liferay Portal.

How do I fix CVE-2022-38512?

Upgrade com.liferay.portal:release.dxp.bom to 7.4.13.u37 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-38512 being exploited?

There is no known exploitation of CVE-2022-38512 in the wild and no public exploit code.

Other vulnerabilities in Liferay Liferay Portal

• CVE-2022-42120 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module Critical 9.8
• CVE-2022-42122 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module Critical 9.8
• CVE-2023-35030 Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module High 8.8
• CVE-2021-29053 Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections High 8.8
• CVE-2021-33321 Liferay Portal and Liferay DXP insecure default configuration High 7.5

All Liferay Liferay Portal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h9ww-wjg4-jvvg.