{"id":"CVE-2020-7961","published":"2020-03-20T19:15:12Z","modified":"2026-06-17T03:25:42Z","title":"Liferay Portal Deserialization of Untrusted Data Vulnerability","vendor":"Liferay","product":"Liferay Portal","tier":"core","eol":null,"description":{"text":"Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).","provenance":"source","from":"NVD"},"summary":{"text":"The Liferay Portal component is affected by a deserialization of untrusted data flaw in versions prior to 7.2.1 CE GA2, within its JSON web services (JSONWS) interface. An attacker with remote network access, requiring no authentication and no user interaction, can exploit this flaw to execute arbitrary code on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99905,"percentile":0.99966,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-7961","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-01-14","exploitedFirstSeen":"2021-01-14","ransomware":false,"evidence":[{"url":"https://www.imperva.com/blog/python-cryptominer-botnet-quickly-adopts-latest-vulnerabilities/","date":"2021-01-14"},{"url":"https://blog.checkpoint.com/2021/01/19/linux-users-should-patch-now-to-block-new-freakout-malware-which-exploits-new-vulnerabilities/","date":"2021-01-19"},{"url":"https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/","date":"2021-01-19"},{"url":"https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html","date":"2021-06-03"},{"url":"https://www.trendmicro.com/en_us/research/21/g/threat-actors-exploit-misconfigured-apache-hadoop-yarn.html","date":"2021-07-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","date":"2022-05-26"},{"url":"https://www.microsoft.com/content/dam/microsoft/final/en-us/microsoft-brand/documents/MDDR_FINAL_2023_1004.pdf","date":"2023-10-09"},{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities","tags":["Broken Link","Vendor Advisory"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271","tags":["Broken Link","Vendor Advisory"]},{"url":"https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities","tags":["Broken Link","Vendor Advisory"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271","tags":["Broken Link","Vendor Advisory"]},{"url":"https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attacker exploits public-facing JSONWS web service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via JSON web services (JSONWS)","start":74,"end":154}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploitation yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":74,"end":123}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.liferay.portal:com.liferay.portal.kernel","vulnerableRanges":["<4.35.3"],"patched":["4.35.3"],"from":["GHSA-w7pm-cc4v-f3g8"],"provenance":"source"}],"advisories":[{"id":"GHSA-w7pm-cc4v-f3g8","url":"https://github.com/advisories/GHSA-w7pm-cc4v-f3g8","severity":"CRITICAL","ecosystem":"Maven","package":"com.liferay.portal:com.liferay.portal.kernel","vulnerableRanges":["<4.35.3"],"patched":["4.35.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5527","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5527","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48332,"url":"https://www.exploit-db.com/exploits/48332","title":"Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)","type":"remote","platform":"java","date":"2020-04-16","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-04-16"},"pocGithub":{"count":7,"skipped":3,"earliest":"2020-03-26","earliestUrl":"https://github.com/mzer0one/CVE-2020-7961-POC","repos":[{"name":"mzer0one/CVE-2020-7961-POC","url":"https://github.com/mzer0one/CVE-2020-7961-POC","stars":117,"created":"2020-03-26"},{"name":"ShutdownRepo/CVE-2020-7961","url":"https://github.com/ShutdownRepo/CVE-2020-7961","stars":18,"created":"2021-01-14"},{"name":"dinosn/liferay-ga4-rce-research","url":"https://github.com/dinosn/liferay-ga4-rce-research","stars":7,"created":"2026-07-28"},{"name":"thelostworldFree/CVE-2020-7961-payloads","url":"https://github.com/thelostworldFree/CVE-2020-7961-payloads","stars":5,"created":"2020-05-23"},{"name":"CrackerCat/CVE-2020-7961-Mass","url":"https://github.com/CrackerCat/CVE-2020-7961-Mass","stars":2,"created":"2021-04-09"}]},"metasploit":[{"name":"Liferay Portal Java Unmarshalling via JSONWS RCE","module":"exploit/multi/http/liferay_java_unmarshalling","type":"exploit","disclosureDate":"2019-11-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb"}],"nuclei":[{"id":"CVE-2020-7961","name":"Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-7961.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7961.yaml"}],"first":{"date":"2019-11-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb"},"provenance":"source"},"exploitRefs":["https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/","http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html","http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-11-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-03-26, Exploit-DB 2020-04-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb","provenance":"source"},{"date":"2020-03-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7961","provenance":"source"},{"date":"2021-01-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.imperva.com/blog/python-cryptominer-botnet-quickly-adopts-latest-vulnerabilities/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5527","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":593},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2114 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 2 NVD exploit links; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}