Deserialization of Untrusted Data in Liferay Portal
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7961US | critical9.8OT critical | KEV | ||
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.htmlWEB
- http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.htmlWEB
- https://github.com/liferay/liferay-portalPACKAGE
- https://github.com/liferay/liferay-portal/blob/7.2.1-ga2/portal-kernel/bnd.bndWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-7961ADVISORY
- https://portal.liferay.dev/learn/security/known-vulnerabilitiesWEB
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271WEB
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnetWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan