CyberSec.Space Logo
返回 CVE 浏览器

CVE-2020-7961

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score82.1730%
EPSS Percentile86.05th
Published2020年3月20日
Last Modified2025年11月7日

Vulnerability Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Affected Platforms (CPE)

📦
Liferay

Liferay Portal

< 7.2.1

References & Advisories

🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
🔗 https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
🔗 http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
🔗 https://portal.liferay.dev/learn/security/known-vulnerabilities

相关漏洞威胁

CVE-2021-339909.8

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor di...

CVE-2019-168919.8

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

CVE-2020-134458.8

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the temp...

CVE-2021-290538.8

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated us...