PT-2020-6321 · Liferay · Liferay Portal

Published 2020-03-20 · Updated 2025-11-07 · CVE-2020-7961

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.2.1 CE GA2

Description The issue is related to the deserialization of untrusted data in Liferay Portal, which allows remote attackers to execute arbitrary code via JSON web services (JSONWS). This is due to shortcomings in the deserialization mechanism. The exploitation of this issue can enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7.2.1 CE GA2, update to version 7.2.1 CE GA2 or later to resolve the issue. As a temporary workaround, consider restricting access to the JSONWS services until a patch is applied. Avoid using the JSONWS services for untrusted data until the issue is resolved.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-04180

CVE-2020-7961

GHSA-W7PM-CC4V-F3G8

Affected Products

Liferay Portal

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb · Exploit
• 🔥 https://github.com/mzer0one/CVE-2020-7961-POC · Exploit
• 🔥 https://github.com/ShutdownRepo/CVE-2020-7961 · Exploit
• 🔥 https://github.com/shacojx/LifeRCEJsonWSTool-POC-CVE-2020-7961-Gui · Exploit
• 🔥 https://github.com/thelostworldFree/CVE-2020-7961-payloads · Exploit
• 🔥 https://github.com/shacojx/POC-CVE-2020-7961-Token-iterate · Exploit
• 🔥 https://exploit-db.com/exploits/48332 · Exploit
• 🔥 https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2020-7961-Mass · Exploit, Deleted
• 🔥 https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html · Exploit
• https://portal.liferay.dev/learn/security/known-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7961 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7961 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7pm-cc4v-f3g8 · Vendor Advisory