Vulnerability identifier: #VU49689

Vulnerability risk: High

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-7961

CWE-ID: CWE-502

Exploitation vector: Network

Exploits in database: 10

• June 17, 2021
  • Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit) [Exploit-DB]
• April 6, 2021
  • LifeRCEJsonWSTool-POC-CVE-2020-7961-Gui () [Github]
  • CVE-2020-7961-payloads (Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)) [Github]
  • GLiferay-CVE-2020-7961-golang (Detect vulns liferay CVE-2020-7961 by Nattroc (EOG Team)) [Github]
• January 24, 2021
  • GLiferay (Detect vulns liferay CVE-2020-7961 by Nattroc (EOG Team)) [Github]
  • POC-CVE-2020-7961-Token-iterate (POC-CVE-2020-7961-Token-iterate) [Github]
• January 21, 2021
  • CVE-2020-7961 (Exploit script for CVE-2020-7961) [Github]
  • CVE-2020-7961-POC () [Github]
• January 20, 2021
  • CVE-2020-7961-Mass (CVE-2020–7961 Mass exploit for Script Kiddies) [Github]
• January 19, 2021
  • Liferay Portal Java Unmarshalling via JSONWS RCE [Metasploit]

Impact: Code execution

Vulnerable software:
Liferay Enterprise Portal
Web applications / CMS

Vendor: