漏洞描述
Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
codewhitesec.blogspot.comhttps://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html↗portal.liferay.devhttps://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-7961↗packetstormsecurity.comhttp://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html↗