liferay/liferay-portal · Security
Liferay Portal Allows RCE via Deserialization of a JSON Payload
- GHSA ID
- GHSA-372h-p48h-xw8q
- CVE ID
- CVE-2019-16891
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16891 ↗
- https://www.liferay.com/downloads-community ↗
- https://www.youtube.com/watch?v=DjMEfQW3bf0 ↗
- https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from ↗
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cst-7111 ↗
- https://github.com/advisories/GHSA-372h-p48h-xw8q ↗