Lucene search

[email protected]CVE-2019-16891

HistoryOct 04, 2019 - 2:15 p.m.

CVE-2019-16891

2019-10-0414:15:11

CWE-502

[email protected]

web.nvd.nist.gov

201

liferay

portal

6.2.5

remote command execution

cve-2019-16891

deserialization

json payload

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Affected configurations

NVD

Node

liferayliferay_portalRange≤6.0.6community

liferayliferay_portalMatch6.1.0b1community

liferayliferay_portalMatch6.1.0b2community

liferayliferay_portalMatch6.1.0b3community

liferayliferay_portalMatch6.1.0b4community

liferayliferay_portalMatch6.1.0ga1community

liferayliferay_portalMatch6.1.0rc1community

liferayliferay_portalMatch6.1.1ga2community

liferayliferay_portalMatch6.1.2ga3community

liferayliferay_portalMatch6.2.0b1community

liferayliferay_portalMatch6.2.0b2community

liferayliferay_portalMatch6.2.0ga1community

liferayliferay_portalMatch6.2.0m1community

liferayliferay_portalMatch6.2.0m2community

liferayliferay_portalMatch6.2.0m3community

liferayliferay_portalMatch6.2.0m4community

liferayliferay_portalMatch6.2.0m5community

liferayliferay_portalMatch6.2.0m6community

liferayliferay_portalMatch6.2.0rc1community

liferayliferay_portalMatch6.2.0rc2community

liferayliferay_portalMatch6.2.0rc3community

liferayliferay_portalMatch6.2.0rc4community

liferayliferay_portalMatch6.2.0rc5community

liferayliferay_portalMatch6.2.0rc6community

liferayliferay_portalMatch6.2.1ga2community

liferayliferay_portalMatch6.2.2ga3community

liferayliferay_portalMatch6.2.3ga4community

liferayliferay_portalMatch6.2.4ga5community

liferayliferay_portalMatch6.2.5ga6community

liferayliferay_portalMatch7.0.0a1community

liferayliferay_portalMatch7.0.0a2community

liferayliferay_portalMatch7.0.0a3community

liferayliferay_portalMatch7.0.0a4community

liferayliferay_portalMatch7.0.0a5community

liferayliferay_portalMatch7.0.0b1community

liferayliferay_portalMatch7.0.0b2community

liferayliferay_portalMatch7.0.0b3community

liferayliferay_portalMatch7.0.0b4community

liferayliferay_portalMatch7.0.0b5community

liferayliferay_portalMatch7.0.0b6community

liferayliferay_portalMatch7.0.0b7community

liferayliferay_portalMatch7.0.0ga1community

liferayliferay_portalMatch7.0.0m1community

liferayliferay_portalMatch7.0.0m2community

liferayliferay_portalMatch7.0.0m3community

liferayliferay_portalMatch7.0.0m4community

liferayliferay_portalMatch7.0.0m5community

liferayliferay_portalMatch7.0.0m6community

liferayliferay_portalMatch7.0.0m7community

liferayliferay_portalMatch7.0.1ga2community

liferayliferay_portalMatch7.0.2ga3community

liferayliferay_portalMatch7.0.3ga4community

liferayliferay_portalMatch7.0.4ga5community

liferayliferay_portalMatch7.0.5ga6community

liferayliferay_portalMatch7.0.6ga7community

liferayliferay_portalMatch7.1.0a1community

liferayliferay_portalMatch7.1.0a2community

liferayliferay_portalMatch7.1.0b1community

liferayliferay_portalMatch7.1.0b2community

liferayliferay_portalMatch7.1.0b3community

liferayliferay_portalMatch7.1.0ga1community

liferayliferay_portalMatch7.1.0m1community

liferayliferay_portalMatch7.1.0m2community

liferayliferay_portalMatch7.1.0rc1community

liferayliferay_portalMatch7.1.1ga2community

liferayliferay_portalMatch7.1.2ga3community

liferayliferay_portalMatch7.1.3ga4community

liferayliferay_portalMatch7.2.0alpha1community

liferayliferay_portalMatch7.2.0beta1community

liferayliferay_portalMatch7.2.0beta2community

liferayliferay_portalMatch7.2.0beta3community

liferayliferay_portalMatch7.2.0m2community

liferayliferay_portalMatch7.2.0rc1community

liferayliferay_portalMatch7.2.0rc2community

liferayliferay_portalMatch7.2.0rc3community

CPENameOperatorVersion
liferay:liferay_portalliferay liferay portalle6.0.6
liferay:liferay_portalliferay liferay portaleq6.1.0
liferay:liferay_portalliferay liferay portaleq6.1.1
liferay:liferay_portalliferay liferay portaleq6.1.2
liferay:liferay_portalliferay liferay portaleq6.2.0
liferay:liferay_portalliferay liferay portaleq6.2.1
liferay:liferay_portalliferay liferay portaleq6.2.2
liferay:liferay_portalliferay liferay portaleq6.2.3
liferay:liferay_portalliferay liferay portaleq6.2.4
liferay:liferay_portalliferay liferay portaleq6.2.5

CPE	Name	Operator	Version
liferay:liferay_portal	liferay liferay portal	le	6.0.6
liferay:liferay_portal	liferay liferay portal	eq	6.1.0
liferay:liferay_portal	liferay liferay portal	eq	6.1.1
liferay:liferay_portal	liferay liferay portal	eq	6.1.2
liferay:liferay_portal	liferay liferay portal	eq	6.2.0
liferay:liferay_portal	liferay liferay portal	eq	6.2.1
liferay:liferay_portal	liferay liferay portal	eq	6.2.2
liferay:liferay_portal	liferay liferay portal	eq	6.2.3
liferay:liferay_portal	liferay liferay portal	eq	6.2.4
liferay:liferay_portal	liferay liferay portal	eq	6.2.5

Rows per page:

1-10 of 221

References

dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from

sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4/

www.liferay.com/downloads-community

www.youtube.com/watch?v=DjMEfQW3bf0

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

Related for CVE-2019-16891

attackerkb1 cvelist1 nvd2 prion1 openvas1 cve1