Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2020-7961
Advisory ID vulnrichment/CVE-2020-7961
Aliases
Summary Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 9.8
ssvc Act
Reference id Reference type URL
http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html
http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
https://portal.liferay.dev/learn/security/known-vulnerabilities
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271
https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
Data source Exploit-DB
Date added April 16, 2020
Description Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
Ransomware campaign use Known
Source publication date April 16, 2020
Exploit type remote
Platform java
Source update date April 16, 2020
Source URL https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb
Data source KEV
Date added Nov. 3, 2021
Description Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.
Required action Apply updates per vendor instructions.
Due date May 3, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2020-7961
Ransomware campaign use Unknown
Data source Metasploit
Description This module exploits a Java unmarshalling vulnerability via JSONWS in Liferay Portal versions < 6.2.5 GA6, 7.0.6 GA7, 7.1.3 GA4, and 7.2.1 GA2 to execute code as the Liferay user. Tested against 7.2.0 GA1.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
  - artifacts-on-disk
Ransomware campaign use Unknown
Source publication date Nov. 25, 2019
Platform Java
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/liferay_java_unmarshalling.rb

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at None
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T19:57:35Z/ Found at None

Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T19:57:35Z/

Decision: Act

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2020/7xxx/CVE-2020-7961.json

Source Advisory: vulnrichment/CVE-2020-7961

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]