CVE-2020-7961criticalunder attackCWE-502

CVE-2020-7961

Published · Updated

Follow this CVE+ Monitor Portal+ Monitor com.liferay.portal:com.liferay.portal.kernel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon6 days
Published on NVDMar 20
1st PoC+6d
metasploitNov 25
CISA KEV+593d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Liferay Portal versions before 7.2.1 CE GA2 have a flaw that allows attackers to run malicious code by sending specially crafted requests through JSON web services. This happens because the system processes untrusted data without proper validation.

Technical detail

CWE-502 deserialization vulnerability in Liferay JSONWS endpoint enables remote code execution when untrusted serialized objects are processed without validation. Attack vector is network-based, requires no authentication pre-condition on exposed JSONWS services, and results in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.