GHSA-w7pm-cc4v-f3g8

Deserialization of Untrusted Data in Liferay Portal

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7961

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay.portal:com.liferay.portal.kernel	< 4.35.3	4.35.3

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7961 advisory
https://github.com/liferay/liferay-portal package
https://github.com/liferay/liferay-portal/blob/7.2.1-ga2/portal-kernel/bnd.bnd web
https://portal.liferay.dev/learn/security/known-vulnerabilities web
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 web
https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet web
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961 web
http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html web
http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html web