Insecure deserialization In com.liferay.portal:release.portal.bom
Description
Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.3.0 | ||
maven | 7.0.10.fp90, 7.1.10.fp17, 7.2.10.fp5 |
Aliases
1. 2. 3. 4.
References
1. 2.