Liferay.Portal.JSONWS.Insecure.Deserialization

description-logoDescription

This indicates an attack attempt to exploit an Insecure Deserialization Vulnerability in Liferay Portal.
This vulnerability is due to insufficient validation of JSONWS requests. A remote unauthenticated attacker can exploit this vulnerability by sending crafted requests to a vulnerable server. Successful exploitation can result in result in arbitrary code execution under the security context of the affected server.

affected-products-logoAffected Products

Liferay Portal 7.2.0 and earlier

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
https://portal.liferay.dev/learn/security/patching

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Detail
2023-08-29 25.629 Sig Added
2023-08-24 25.627 Sig Added
2020-07-22 15.892 Default_action:pass:drop
2020-05-11 15.841 Sig Added
2020-05-06 15.838
2020-05-06 15.837
2020-05-06 15.836