CVE-2019-16891

CRITICAL

Liferay Portal CE 6.2.5 - Code Injection

Title source: llm
STIX 2.1

Description

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Exploits (1)

nomisec STUB
by rai0ffs3c · poc
https://github.com/rai0ffs3c/CVE-2019-16891-Liferay-deserialization-RCE

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.7956
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (12)
com.liferay.portal/release.portal.bom 0 - 7.1.1Maven
liferay/liferay_portal 6.1.0 b1 (6 CPE variants)
liferay/liferay_portal 6.1.1 ga2
liferay/liferay_portal 6.1.2 ga3
liferay/liferay_portal 6.2.0 b1 (15 CPE variants)
liferay/liferay_portal 6.2.1 ga2
liferay/liferay_portal 6.2.2 ga3
liferay/liferay_portal 6.2.3 ga4
liferay/liferay_portal 6.2.4 ga5
liferay/liferay_portal 6.2.5 ga6
... and 2 more
Published Oct 04, 2019
Tracked Since Feb 18, 2026