Liferay : Security Vulnerabilities, CVEs, Published In 2020 (Code Execution)
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
Max CVSS
8.1
EPSS Score
0.13%
Published
2020-07-20
Updated
2020-07-24
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
Max CVSS
8.8
EPSS Score
2.12%
Published
2020-06-10
Updated
2021-07-21
CVE-2020-7961
Known exploited
Public exploit
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Max CVSS
9.8
EPSS Score
97.47%
Published
2020-03-20
Updated
2021-01-30
CISA KEV Added
2021-11-03
3 vulnerabilities found