Liferay Portal CVE-2020-7961

The exploitable prerequisite is a reachable Liferay Portal JSONWS (JSON web services) interface, exposed by default under paths such as /api/jsonws, on a Community Edition instance older than 7.2.1 CE GA2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required against a default installation - exploitation succeeds simply by reaching the JSONWS endpoint over the network. The primary limiting factors are therefore version (must be pre-7.2.1 CE GA2) and network exposure of the JSONWS endpoint: deployments that firewall, proxy-restrict, or disable JSONWS, or that have upgraded, are not exploitable via this path.

This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk case, and all signals reinforce each other. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates trivial network exploitation with no privileges or interaction and full impact; the EPSS score of 99.78% (100th percentile) is near the theoretical maximum for exploitation probability; the vulnerability is on the CISA KEV list as confirmed actively exploited; and public exploit code exists (Exploit-DB 48332, PacketStorm). Unlike cases where EPSS is low despite KEV listing (implying targeted use), here high EPSS, KEV, and public POC all agree, indicating broad, opportunistic, automatable exploitation - consistent with its documented use in the FreakOut botnet. No signals conflict. The primary residual uncertainty is version/edition scope: the CPE and description focus on Community Edition prior to 7.2.1 CE GA2, but Liferay's advisory also covered corresponding DXP/EE fix packs, so operators of enterprise editions should verify against the vendor advisory rather than assume they are unaffected.

An unauthenticated attacker sends a crafted HTTP request to Liferay's JSONWS endpoint containing a malicious serialized Java object graph. Upon deserialization, a gadget chain executes attacker-controlled code as the portal service account, enabling installation of malware - as demonstrated by the FreakOut botnet, which used this flaw for mass compromise. Public exploit code (Exploit-DB 48332 and PacketStorm) makes this attack low-effort and repeatable.