Vulnerability details

CVE-2020-7961

Actively exploited

Liferay Liferay Portal

CVSS 3.1

9.8Critical

Official description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://portal.liferay.dev/learn/security/known-vulnerabilities x_refsource_MISC
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 x_refsource_CONFIRM
http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html x_refsource_MISC
http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html x_refsource_MISC
https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2020-03-20
Last updated: 2025-10-22
State: Published
Assigner (CNA): mitre
Kolun priority: 80 · High

CISA KEV catalog

Date added: 2021-11-03
Due date: 2022-05-03
Used in ransomware: Unknown

Exploit prediction (EPSS)

99.9%

Probability of exploitation in 30 days