CVE-2020-7961

Liferay Portal Deserialization of Untrusted Data Vulnerability

Liferay Portal

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

20. Mär 2020

Ausgewertete Quellen

• Hersteller
  https://portal.liferay.dev/learn/security/known-vulnerabilities
• Hersteller
  https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
• Hinweis
  http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
• Hinweis
  http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
• Hinweis
  https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961
• CISA
  Liferay Portal Deserialization of Untrusted Data Vulnerability
• NVD
  CVE-2020-7961