CVE-2020-7961

CRITICALCISA KEV

9.8

Beschreibung

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/20/2020

Zuletzt geandert11/7/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerLiferay

ProduktLiferay Portal

SchwachstellennameLiferay Portal Deserialization of Untrusted Data Vulnerability

KEV Aufnahmedatum2021-11-03

Behebungsfrist2022-05-03

Ransomware-NutzungUnknown

Betroffene Produkte

liferay:liferay_portal

Schwachen (CWE)

CWE-502CWE-502

Referenzen

http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html(cve@mitre.org)

http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html(cve@mitre.org)

https://portal.liferay.dev/learn/security/known-vulnerabilities(cve@mitre.org)

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271(cve@mitre.org)

https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/(cve@mitre.org)

http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://portal.liferay.dev/learn/security/known-vulnerabilities(af854a3a-2127-422b-91ae-364da2661108)

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271(af854a3a-2127-422b-91ae-364da2661108)

https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.