CVE-2019-16891

Exploit

EPSS 45.65%
Veröffentlicht 04.10.2019 14:15:11
Zuletzt bearbeitet 21.11.2024 04:31:17
Erkennungen
Login

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

NVD 75 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Liferay Portal SwEdition community Version <= 6.0.6

Liferay ≫ Liferay Portal Version 6.1.0 Update b1 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.0 Update b2 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.0 Update b3 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.0 Update b4 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.0 Update ga1 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.0 Update rc1 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.1 Update ga2 SwEdition community

Liferay ≫ Liferay Portal Version 6.1.2 Update ga3 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update b1 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update b2 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update ga1 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m1 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m2 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m3 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m4 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m5 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update m6 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc1 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc2 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc3 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc4 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc5 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.0 Update rc6 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.1 Update ga2 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.2 Update ga3 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.3 Update ga4 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.4 Update ga5 SwEdition community

Liferay ≫ Liferay Portal Version 6.2.5 Update ga6 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update a1 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update a2 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update a3 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update a4 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update a5 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b1 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b2 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b3 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b4 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b5 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b6 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update b7 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update ga1 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m1 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m2 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m3 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m4 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m5 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m6 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.0 Update m7 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.1 Update ga2 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.2 Update ga3 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.3 Update ga4 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.4 Update ga5 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.5 Update ga6 SwEdition community

Liferay ≫ Liferay Portal Version 7.0.6 Update ga7 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update a1 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update a2 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update b1 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update b2 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update b3 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update ga1 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update m1 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update m2 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.0 Update rc1 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.1 Update ga2 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.2 Update ga3 SwEdition community

Liferay ≫ Liferay Portal Version 7.1.3 Update ga4 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update alpha1 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update beta1 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update beta2 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update beta3 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update m2 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update rc1 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update rc2 SwEdition community

Liferay ≫ Liferay Portal Version 7.2.0 Update rc3 SwEdition community

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	45.65%	0.986

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from

Third Party Advisory

Exploit

https://sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4/

Third Party Advisory

Exploit

https://www.liferay.com/downloads-community

Product

Release Notes

https://www.youtube.com/watch?v=DjMEfQW3bf0

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2019-16891

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-16891

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-16891

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-16891