CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Recent assessments:

gwillcox-r7 at January 21, 2021 3:53am UTC reported:

This has now been reported as being exploited in the wild as part of the FreakOut attacks as first reported by CheckPoint Research at <https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/&gt;.

theguly at March 30, 2020 3:49pm UTC reported:

This has now been reported as being exploited in the wild as part of the FreakOut attacks as first reported by CheckPoint Research at <https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/&gt;.

Mad-robot at July 05, 2020 1:58pm UTC reported:

This has now been reported as being exploited in the wild as part of the FreakOut attacks as first reported by CheckPoint Research at <https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/&gt;.

wvu-r7 at April 08, 2020 6:31pm UTC reported:

This has now been reported as being exploited in the wild as part of the FreakOut attacks as first reported by CheckPoint Research at <https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/&gt;.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5