module
Liferay Portal Java Unmarshalling via JSONWS RCE
| Disclosed |
|---|
| Nov 25, 2019 |
Disclosed
Nov 25, 2019
Description
This module exploits a Java unmarshalling vulnerability via JSONWS in
Liferay Portal versions GA2 to execute code as the Liferay user. Tested against 7.2.0 GA1.
Liferay Portal versions GA2 to execute code as the Liferay user. Tested against 7.2.0 GA1.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.