8.1

CVE-2020-15842

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Liferay ≫ Digital Experience Platform Version 7.0 Update -
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_13
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_14
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_24
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_25
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_26
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_27
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_28
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_3
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_30
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_33
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_35
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_36
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_39
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_40
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_41
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_42
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_43
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_44
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_45
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_46
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_47
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_48
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_49
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_50
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_51
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_52
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_53
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_54
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_56
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_57
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_58
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_59
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_60
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_61
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_64
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_65
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_66
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_67
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_68
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_69
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_70
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_71
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_72
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_73
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_75
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_76
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_78
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_79
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_80
Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_81
Liferay ≫ Digital Experience Platform Version 7.1 Update -
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_1
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_10
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_11
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_12
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_13
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_14
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_15
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_16
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_2
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_3
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_4
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_5
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_6
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_7
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_8
Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_9
Liferay ≫ Digital Experience Platform Version 7.2 Update -
Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1
Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2
Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3
Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4
Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5
Liferay ≫ Liferay Portal Version < 7.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.78% 0.756
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
MITRE 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://issues.liferay.com/browse/LPE-16963
Vendor Advisory
Issue Tracking
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427
Vendor Advisory