CyberSec.Space Logo
CVEブラウザに戻る

CVE-2020-7961

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score82.1730%
EPSS Percentile86.05th
Published2020年3月20日
Last Modified2025年11月7日

Vulnerability Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Affected Platforms (CPE)

📦
Liferay

Liferay Portal

< 7.2.1

References & Advisories

🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
🔗 https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities

関連する脆弱性情報

CVE-2021-339909.8

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor di...

CVE-2019-168919.8

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

CVE-2020-134458.8

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the temp...

CVE-2021-290538.8

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated us...