Every CVE Search/ Get API key

CVE-2019-16891

Liferay Portal Allows RCE via Deserialization of a JSON Payload

9.8 CriticalPublic exploitFix available

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

44.7%Up 42.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Record
CVE-2019-16891
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Record
CVE-2019-16891
Updated
2026-11-02
EUVDEUVD-2019-7390 No score

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Record
EUVD-2019-7390
Updated
2026-11-03
GitHub AdvisoriesGHSA-372h-p48h-xw8q 9.8

Liferay Portal Allows RCE via Deserialization of a JSON Payload

Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload.

Record
GHSA-372h-p48h-xw8q
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 9.8

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

Record
CVE-2019-16891
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-372h-p48h-xw8q 9.8

Liferay Portal Allows RCE via Deserialization of a JSON Payload

Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload.

Record
GHSA-372h-p48h-xw8q
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.liferay.portal:release.portal.bom
Maven
 before 7.1.1
7.1.1
com.liferay.portal:release.portal.bom
Maven
 before 7.1.1, plus listed versions
7.0.67.0.6-17.0.6-27.1.0
7.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubrai0ffs3c/CVE-2019-16891-Liferay-deserialization-RCE2025-05-06

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-16891 is a critical vulnerability (CVSS 9.8) in Liferay Portal, published October 4, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 44.7%, the 98th percentile. Fixed in com.liferay.portal:release.portal.bom 7.1.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open