by Kastro
Paper/Archive/CVE-2020-7961

CVE-2020-7961

Liferay Liferay Portal — Liferay Portal Deserialization of Untrusted Data Vulnerability

KEV · due 3 MayEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refportal.liferay.dev/learn/security/known-vulnerabilitiesrefportal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271refpacketstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.htmlrefresearch.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnetrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961kevcisa.gov/known-exploited-vulnerabilities-catalog