CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-03-20
Liferay Portal JSONWS Untrusted Data Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-7961)
[Affected Scope] Liferay Portal versions prior to 7.2.1 CE GA2
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting the JSON web services (JSONWS) API to deserialize untrusted Java objects
[Mitigation] Immediately upgrade Liferay Portal to version 7.2.1 CE GA2 or later, and restrict external access to the JSONWS API endpoints