Description
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay:com.liferay.translation.web | < 2.0.58 | 2.0.58 | GHSA-h9ww-wjg4-jvvg |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.4.13.u8, < 7.4.13.u37 | 7.4.13.u37 | GHSA-h9ww-wjg4-jvvg |