GitHub Advisoryadvisory · Maven

GHSA-w7pm-cc4v-f3g8 Deserialization of Untrusted Data in Liferay Portal

CRITICAL Published 2022-05-24 Modified 2025-10-22 Official page ↗
Aliases
CVE-2020-7961
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.kernel
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-502
Reviewed
2022-06-23

Affected packages

• Maven com.liferay.portal:com.liferay.portal.kernel: < 4.35.3 → fixed in 4.35.3

Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Related

Alias · CVE (1)

  • CVE-2020-7961 Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References