CyberSec.Space Logo
Back to CVE Browser

CVE-2020-7961

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score82.1730%
EPSS Percentile86.05th
PublishedMar 20, 2020
Last ModifiedNov 7, 2025

Vulnerability Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Affected Platforms (CPE)

📦
Liferay

Liferay Portal

< 7.2.1

References & Advisories

🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
🔗 https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities

Related Vulnerabilities

CVE-2021-339909.8

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor di...

CVE-2019-168919.8

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

CVE-2020-134458.8

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the temp...

CVE-2021-290538.8

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated us...