| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.portal:release.dxp.bom | ≥ 7.4.13.u8, < 7.4.13.u37 | 7.4.13.u37 |
| com.liferay:com.liferay.translation.web | < 2.0.58 | 2.0.58 |
| dxp | = 7.4 | |
| liferay portal | ≥ 7.4.3.12, ≤ 7.4.3.36 |
The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free