CVE-2020-7961

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-79625.3An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an at CVE-2020-79645.3An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attacker CVE-2020-79658.8flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the CVE-2020-79667.5GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-79674.3GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-79687.5GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.CVE-2020-79697.5GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.CVE-2020-79716.1GitLab EE 11.0 and later through 12.7.2 allows XSS.CVE-2020-79727.5GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).CVE-2020-79736.1GitLab through 12.7.2 allows XSS.CVE-2020-79745.3GitLab EE 10.1 through 12.7.2 allows Information Disclosure.CVE-2020-79765.3GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.