CVE-2020-7961 Liferay Portal
| Affected software | Liferay Portal |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 4.35.3 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 20 Mar 2020 |
| Updated | 17 Jun 2026 |
Description
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 15 citations · honeypot sightings · 11 exploits · earliest 2021-01-14.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 10 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2020-03-26.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-7961 in VulnCheck (free account), which lists 10 more citations and 6 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 25 days | 2025-10-17 to 2026-10-30 |
| Reported exploitation | imperva.com | /blog/python-cryptominer-botnet-quickly-adopts-latest-vulnerabilities | 2021-01-14 |
| Reported exploitation | blog.checkpoint.com | /2021/01/19/linux-users-should-patch-now-to-block-new-freakout-malware-which-exploits-new-vulnerabilities | 2021-01-19 |
| Reported exploitation | research.checkpoint.com | /2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet | 2021-01-19 |
| Reported exploitation | blog.talosintelligence.com | /2021/06/necro-python-bot-adds-new-tricks.html | 2021-06-03 |
| Reported exploitation | trendmicro.com | /en_us/research/21/g/threat-actors-exploit-misconfigured-apache-hadoop-yarn.html | 2021-07-27 |
| Exploit reference | VulnCheck XDB beb61a49daa0 | Exploit type: initial-access | 2020-03-26 |
| Exploit reference | VulnCheck XDB 5fbe8f7dc4b1 | Exploit type: initial-access | 2020-03-29 |
| Exploit reference | VulnCheck XDB d888e243ebd9 | Exploit type: initial-access | 2020-05-23 |
| Exploit reference | VulnCheck XDB 6e87149cbdcd | Exploit type: initial-access | 2021-01-14 |
| Exploit reference | VulnCheck XDB 76603fe1d8bb | Exploit type: initial-access | 2021-04-09 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization, Process
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR deserialization security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-502: Deserialization of Untrusted Data. |
How to mitigate CVE-2020-7961
Upgrade Liferay Portal to 4.35.3 or later. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.liferay.portal:com.liferay.portal.kernel |
0 | 4.35.3 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | com.liferay.portal | com.liferay.portal.kernel | generic | ＜ 4.35.3 |
| nvd | liferay | liferay portal | generic | ＜ 7.2.1 |
References
Timeline
Timeline
| Published | 2020-03-20 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-01-14 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-08 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |