What is the CVSS score of CVE-2020-7961?

CVE-2020-7961 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 99.8%.

Which versions of Liferay Portal are affected by CVE-2020-7961?

Liferay Portal Community Edition versions prior to 7.2.1 GA2 are vulnerable to remote code execution (CVE-2020-7961) requiring no authentication, enabling attackers to gain complete system control.. A patch is available.

Is there a public PoC exploit available for CVE-2020-7961?

Yes, a public proof-of-concept exploit is available for CVE-2020-7961. Prioritise patching immediately. EPSS: 99.8%.

How to fix or mitigate CVE-2020-7961?

Within 24 hours, identify all Liferay Portal CE instances running versions prior to 7.2.1 GA2 and immediately restrict network access if emergency patching is not feasible today. Within 7 days, deploy the vendor-released patch by upgrading all instances to Liferay Portal CE version 7.2.1 GA2 or later, starting with production systems. Within 30 days, conduct forensic analysis of affected systems for compromise indicators, review complete access and authentication logs for exploitation attempts, and implement network segmentation and Web Application Firewall rules to limit Liferay exposure.

Liferay Portal CVE-2020-7961

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2020-03-20 cve@mitre.org

Deserialization RCE Liferay Portal

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable JSONWS endpoint (AV:N/PR:N/UI:N) with straightforward deserialization exploitation (AC:L) yielding full RCE, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 17, 2026 - 10:06 vuln.today

v1 (manual)

Added to CISA KEV

Jul 13, 2026 - 07:01 CISA

CVE Published

Mar 20, 2020 - 19:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on com.liferay.portal:com.liferay.portal.kernel (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.35.3.

DescriptionNVD

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

AnalysisAI

Remote code execution in Liferay Portal Community Edition (CE) versions prior to 7.2.1 CE GA2 allows unauthenticated remote attackers to run arbitrary Java code by abusing the JSON web services (JSONWS) interface. This flaw is confirmed actively exploited (CISA KEV) - it was leveraged by the 'FreakOut' botnet - with publicly available exploit code and an EPSS score of 99.78% (100th percentile), placing it among the most likely to be exploited vulnerabilities. It carries a CVSS 9.8, reflecting network-reachable, no-authentication, no-interaction exploitation with full confidentiality, integrity, and availability impact.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data). Liferay Portal exposes a JSON web services (JSONWS) API that allows remote clients to invoke service methods and pass typed arguments. The deserialization mechanism reconstructs arbitrary Java objects from attacker-supplied JSON, allowing an attacker to instantiate gadget classes present on the classpath and coerce them into executing code (Java 'unmarshalling'/gadget-chain style exploitation). The affected component per CPE is cpe:2.3:a:liferay:liferay_portal (community edition), and PacketStorm advisories explicitly describe this as 'Java Unmarshalling Remote Code Execution.' Because the JSONWS endpoint is often reachable without authentication in default deployments, the unmarshalling of untrusted object graphs becomes a direct path to code execution on the server.

RemediationAI

Upgrade to a fixed release: Vendor-released patch - Liferay Portal 7.2.1 CE GA2 or later resolves the issue (per Liferay advisory at https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271); enterprise (DXP/EE) users should apply the equivalent vendor fix pack referenced in the same advisory. Where immediate patching is not possible, restrict network access to the JSONWS endpoint (typically under /api/jsonws) by blocking or firewalling it from untrusted networks, or disable JSONWS if the deployment does not require it - noting that disabling it will break any integrations or portlets that depend on the JSON web services API. Additionally place the portal behind a reverse proxy/WAF and deny external requests to the JSONWS path, and audit for indicators of compromise given confirmed active exploitation. Consult https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7961 for KEV remediation timelines.