Vulnerability in N/a
CVE-2019-16891
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
EPSS: 0.796 (99.1th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
- rai0ffs3c/CVE-2019-16891-Liferay-deserialization-RCE
- ARPSyndicate/cvemon
- AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- BrittanyKuhn/javascript-tutorial
- GrrrDog/Java-Deserialization-Cheat-Sheet
- HPT-Intern-Task-Submission/Liferay-JSON-Deserialization
- JoshMorrison99/my-nuceli-templates
- PalindromeLabs/Java-Deserialization-CVEs
- Y4tacker/JavaSec
- hrxknight/CVE-2019-16891-Liferay-deserialization-RCE
References
Frequently asked questions
- What is CVE-2019-16891?
- CVE-2019-16891 is a vulnerability in N/a. Published 2019-10-04.
- Is CVE-2019-16891 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.