CVE-2020-7961

critical

Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

References

Advisories
More

http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html

http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html

https://github.com/dinosn/liferay-ga4-rce-research

https://github.com/advisories/GHSA-w7pm-cc4v-f3g8

https://github.com/ShutdownRepo/CVE-2020-7961

https://github.com/shacojx/POC-CVE-2020-7961-Token-iterate

https://github.com/shacojx/GLiferay-CVE-2020-7961-golang

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961

https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271

https://portal.liferay.dev/learn/security/known-vulnerabilities

Details

Source: Mitre, NVD

Published: 2020-03-20

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N