Description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.

Remediation

References

CVE-2020-15842

Related Vulnerabilities

Atlassian Jira CVE-2020-4029 Vulnerability (CVE-2020-4029)

SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17303)

MySQL CVE-2022-21304 Vulnerability (CVE-2022-21304)

Moodle Credentials Management Errors Vulnerability (CVE-2009-4304)

WordPress Plugin WP SVG images Cross-Site Scripting (3.3)

Severity

High

Classification

CVE-2020-15842 CWE-502

Tags

Missing Update Known Vulnerabilities