CVE-2019-16891: Critical severity liferay 7.4 ga vulnerability
Published Oct 4, 2019
·Updated
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
Affected Software
75 affected components
Liferay Liferay Portal<=6.0.6
Liferay Liferay Portal=6.1.0-b1
Liferay Liferay Portal=6.1.0-b2
Liferay Liferay Portal=6.1.0-b3
Liferay Liferay Portal=6.1.0-b4
Liferay Liferay Portal=6.1.0-ga1
Liferay Liferay Portal=6.1.0-rc1
Liferay Liferay Portal=6.1.1-ga2
Liferay Liferay Portal=6.1.2-ga3
Liferay Liferay Portal=6.2.0-b1
Liferay Liferay Portal=6.2.0-b2
Liferay Liferay Portal=6.2.0-ga1
Liferay Liferay Portal=6.2.0-m1
Liferay Liferay Portal=6.2.0-m2
Liferay Liferay Portal=6.2.0-m3
Liferay Liferay Portal=6.2.0-m4
Liferay Liferay Portal=6.2.0-m5
Liferay Liferay Portal=6.2.0-m6
Liferay Liferay Portal=6.2.0-rc1
Liferay Liferay Portal=6.2.0-rc2
Liferay Liferay Portal=6.2.0-rc3
Liferay Liferay Portal=6.2.0-rc4
Liferay Liferay Portal=6.2.0-rc5
Liferay Liferay Portal=6.2.0-rc6
Liferay Liferay Portal=6.2.1-ga2
Liferay Liferay Portal=6.2.2-ga3
Liferay Liferay Portal=6.2.3-ga4
Liferay Liferay Portal=6.2.4-ga5
Liferay Liferay Portal=6.2.5-ga6
Liferay Liferay Portal=7.0.0-a1
Liferay Liferay Portal=7.0.0-a2
Liferay Liferay Portal=7.0.0-a3
Liferay Liferay Portal=7.0.0-a4
Liferay Liferay Portal=7.0.0-a5
Liferay Liferay Portal=7.0.0-b1
Liferay Liferay Portal=7.0.0-b2
Liferay Liferay Portal=7.0.0-b3
Liferay Liferay Portal=7.0.0-b4
Liferay Liferay Portal=7.0.0-b5
Liferay Liferay Portal=7.0.0-b6
Liferay Liferay Portal=7.0.0-b7
Liferay Liferay Portal=7.0.0-ga1
Liferay Liferay Portal=7.0.0-m1
Liferay Liferay Portal=7.0.0-m2
Liferay Liferay Portal=7.0.0-m3
Liferay Liferay Portal=7.0.0-m4
Liferay Liferay Portal=7.0.0-m5
Liferay Liferay Portal=7.0.0-m6
Liferay Liferay Portal=7.0.0-m7
Liferay Liferay Portal=7.0.1-ga2
Liferay Liferay Portal=7.0.2-ga3
Liferay Liferay Portal=7.0.3-ga4
Liferay Liferay Portal=7.0.4-ga5
Liferay Liferay Portal=7.0.5-ga6
Liferay Liferay Portal=7.0.6-ga7
Liferay Liferay Portal=7.1.0-a1
Liferay Liferay Portal=7.1.0-a2
Liferay Liferay Portal=7.1.0-b1
Liferay Liferay Portal=7.1.0-b2
Liferay Liferay Portal=7.1.0-b3
Liferay Liferay Portal=7.1.0-ga1
Liferay Liferay Portal=7.1.0-m1
Liferay Liferay Portal=7.1.0-m2
Liferay Liferay Portal=7.1.0-rc1
Liferay Liferay Portal=7.1.1-ga2
Liferay Liferay Portal=7.1.2-ga3
Liferay Liferay Portal=7.1.3-ga4
Liferay Liferay Portal=7.2.0-alpha1
Liferay Liferay Portal=7.2.0-beta1
Liferay Liferay Portal=7.2.0-beta2
Liferay Liferay Portal=7.2.0-beta3
Liferay Liferay Portal=7.2.0-m2
Liferay Liferay Portal=7.2.0-rc1
Liferay Liferay Portal=7.2.0-rc2
Liferay Liferay Portal=7.2.0-rc3
Event History
Oct 4, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16891?
CVE-2019-16891 is classified as a critical severity vulnerability allowing remote command execution.
2
How do I fix CVE-2019-16891?
To fix CVE-2019-16891, users should update their Liferay Portal to version 6.2.6 or higher.
3
What is the impact of CVE-2019-16891?
CVE-2019-16891 allows attackers to execute arbitrary commands on the server, leading to potential data breaches and system compromise.
4
Which versions of Liferay are affected by CVE-2019-16891?
Liferay Portal CE versions prior to 6.2.6 are vulnerable to CVE-2019-16891.
5
Is CVE-2019-16891 exploitable remotely?
Yes, CVE-2019-16891 is exploitable remotely, allowing attackers to target vulnerable instances over the internet.