CVE-2020-15842

2020-07-2002:15:11

Google

osv.dev

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.5%

JSON

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.

CPENameOperatorVersion
liferay-portaleq7.2.0-m2
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.6-b7
liferay-portaleqsync-3.0.8-b9
liferay-portaleq6.1.0-b4
liferay-portaleq7.1.0-b1
liferay-portaleqsync-3.0.4-b5
liferay-portaleqsync-3.0.7-b8
liferay-portaleq7.1.0-m2
liferay-portaleq7.2.0-b1

Name	Operator	Version
liferay-portal	eq	7.2.0-m2
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.6-b7
liferay-portal	eq	sync-3.0.8-b9
liferay-portal	eq	6.1.0-b4
liferay-portal	eq	7.1.0-b1
liferay-portal	eq	sync-3.0.4-b5
liferay-portal	eq	sync-3.0.7-b8
liferay-portal	eq	7.1.0-m2
liferay-portal	eq	7.2.0-b1