GitHub Advisoryadvisory · Maven
GHSA-372h-p48h-xw8q Liferay Portal Allows RCE via Deserialization of a JSON Payload
CRITICAL
Official page ↗
- Aliases
- CVE-2019-16891
- Ecosystem
- Maven
- Packages
- com.liferay.portal:release.portal.bom
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2025-08-08
Affected packages
• Maven com.liferay.portal:release.portal.bom: < 7.1.1 → fixed in 7.1.1
Description
Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload.
Related
Alias · CVE (1)
- CVE-2019-16891 Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16891 advisory
- https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from web
- https://github.com/liferay/liferay-portal package
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cst-7111 web
- https://www.liferay.com/downloads-community web
- https://www.youtube.com/watch?v=DjMEfQW3bf0 web