CVE-2022-38512: Liferay Portal and Liferay DXP Translation Module Permission Bypass Vulnerability
Summary
CVE-2022-38512: Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module. Affects com.liferay:com.liferay.translation.web versions < 2.0.58. Fixed in 2.0.58. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for creating and managing web content, including translation features that allow users to export content for localization. However, certain versions of the Translation module have a critical flaw that allows unauthorized access to sensitive translation files.
Vulnerability Detail
The vulnerability arises from a lack of permission checks in the Translation module of Liferay Portal and Liferay DXP. Specifically, versions prior to v2.0.58 for the Translation module and Liferay DXP versions 7.4 update 8 through 36 do not properly validate user permissions before allowing the export of web content for translation. This oversight enables attackers to exploit crafted URLs to download XLIFF translation files, potentially exposing sensitive content. The ramifications of this vulnerability include unauthorized access to confidential information and the potential for data leaks.
How To Fix
Latest published version: 2.0.119 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.58
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Translation module by configuring user roles and permissions to limit who can export web content for translation. This can be done through the Liferay Control Panel under User Roles.
Conclusion
In summary, CVE-2022-38512 is a significant vulnerability in the Liferay Portal and Liferay DXP Translation module that can lead to unauthorized access to sensitive translation files. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your web applications.
See every vulnerability recorded for com.liferay:com.liferay.translation.web →
FAQ
CVE-2022-38512 is a vulnerability in the Liferay Portal and Liferay DXP Translation module that allows unauthorized users to download sensitive translation files due to insufficient permission checks.
The affected versions include Liferay Portal Translation module versions prior to 2.0.58 and Liferay DXP versions 7.4 update 8 through 36.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The risks include unauthorized access to sensitive web content and potential data leaks, which could compromise user privacy and security.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.translation.web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
