Description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.

Remediation

References

CVE-2020-15842

Related Vulnerabilities

WordPress Plugin Sign-up Sheets Cross-Site Scripting (1.0.13)

WordPress Plugin Easy Cookies Policy Cross-Site Scripting (1.6.2)

WordPress Plugin Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Cross-Site Scripting (9.7.1)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-3064)

OpenSSL Other Vulnerability (CVE-2002-1568)

Severity

High

Classification

CVE-2020-15842 CWE-502

Tags

Missing Update Known Vulnerabilities