CVE-2022-38512: 
Java vulnerability analysis and mitigation

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 contains a security vulnerability where the system does not check permissions before allowing users to export web content for translation. This vulnerability was discovered and disclosed on September 21, 2022, and is tracked as CVE-2022-38512 (Liferay Security).

The vulnerability has been assigned a CVSS v3.1 score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating a medium severity level. The vulnerability exists in the Translation module's permission checking mechanism, which fails to validate user permissions before allowing access to web content translation export functionality (Liferay Security).

The vulnerability allows remote attackers to download a web content page's XLIFF translation file via crafted URLs, potentially exposing sensitive content that should be restricted. This could lead to unauthorized access to web content that was intended to be protected (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.37. Organizations using affected versions should upgrade to this version or later to protect against this vulnerability (Liferay Security).