Liferay · Liferay Portal
The Liferay Portal component is affected by a deserialization of untrusted data flaw in versions prior to 7.2.1 CE GA2, within its JSON web services (JSONWS) interface. An attacker with remote network access, requiring no authentication and no user interaction, can exploit this flaw to execute arbitrary code on the server.
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
First seen exploited 10 months after disclosure. Public exploit code (Metasploit) was available 4 months before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote attacker exploits public-facing JSONWS web service
allows remote attackers to execute arbitrary code via JSON web services (JSONWS)
Successful exploitation yields arbitrary code execution
allows remote attackers to execute arbitrary code
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: com.liferay.portal:com.liferay.portal.kernel.
Upgrade to 4.35.3 or later
Set the version to 4.35.3 or later in your pom.xml or build.gradle.
The first fix for CVE-2020-7961. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 4.35.3 | 4.35.3 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.