The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.liferay:com.liferay.translation.web(Maven) | 0 | 2.0.58 | N/A |
| com.liferay.portal:release.dxp.bom(Maven) | 7.4.13.u8 | 7.4.13.u37 | N/A |
CVSS Metrics
