Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
Severity
High 8.1
Published
20 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.3.0
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 7.2-fix_pack_5
Version 7.2-fix_pack_4
Version 7.2-fix_pack_3
Version 7.2-fix_pack_2
All 74 release lines
Version 7.0
Version 7.0-fix_pack_3
Version 7.0-fix_pack_13
Version 7.0-fix_pack_14
Version 7.0-fix_pack_24
Version 7.0-fix_pack_25
Version 7.0-fix_pack_26
Version 7.0-fix_pack_27
Version 7.0-fix_pack_28
Version 7.0-fix_pack_30
Version 7.0-fix_pack_33
Version 7.0-fix_pack_35
Version 7.0-fix_pack_36
Version 7.0-fix_pack_39
Version 7.0-fix_pack_40
Version 7.0-fix_pack_41
Version 7.0-fix_pack_42
Version 7.0-fix_pack_43
Version 7.0-fix_pack_44
Version 7.0-fix_pack_45
Version 7.0-fix_pack_46
Version 7.0-fix_pack_47
Version 7.0-fix_pack_48
Version 7.0-fix_pack_49
Version 7.0-fix_pack_50
Version 7.0-fix_pack_51
Version 7.0-fix_pack_52
Version 7.0-fix_pack_53
Version 7.0-fix_pack_54
Version 7.0-fix_pack_56
Version 7.0-fix_pack_57
Version 7.0-fix_pack_58
Version 7.0-fix_pack_59
Version 7.0-fix_pack_60
Version 7.0-fix_pack_61
Version 7.0-fix_pack_64
Version 7.0-fix_pack_65
Version 7.0-fix_pack_66
Version 7.0-fix_pack_67
Version 7.0-fix_pack_68
Version 7.0-fix_pack_69
Version 7.0-fix_pack_70
Version 7.0-fix_pack_71
Version 7.0-fix_pack_72
Version 7.0-fix_pack_73
Version 7.0-fix_pack_75
Version 7.0-fix_pack_76
Version 7.0-fix_pack_78
Version 7.0-fix_pack_79
Version 7.0-fix_pack_80
Version 7.0-fix_pack_81
Version 7.1
Version 7.1-fix_pack_1
Version 7.1-fix_pack_2
Version 7.1-fix_pack_3
Version 7.1-fix_pack_4
Version 7.1-fix_pack_5
Version 7.1-fix_pack_6
Version 7.1-fix_pack_7
Version 7.1-fix_pack_8
Version 7.1-fix_pack_9
Version 7.1-fix_pack_10
Version 7.1-fix_pack_11
Version 7.1-fix_pack_12
Version 7.1-fix_pack_13
Version 7.1-fix_pack_14
Version 7.1-fix_pack_15
Version 7.1-fix_pack_16
Version 7.2
Version 7.2-fix_pack_1
Version 7.2-fix_pack_2
Version 7.2-fix_pack_3
Version 7.2-fix_pack_4
Version 7.2-fix_pack_5
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal