{"id":"CVE-2019-16891","details":"Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.","aliases":["GHSA-372h-p48h-xw8q"],"modified":"2026-09-05T03:31:08.953261745Z","published":"2019-10-04T14:15:11.030Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*"],"extracted_events":[{"last_affected":"6.0.6"}],"source":"CPE_RANGE","vendor_product":"liferay:liferay_portal"},{"cpes":["cpe:2.3:a:liferay:liferay_portal:7.2.0:alpha1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:beta1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:beta2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:beta3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:rc1:*:*:community:*:*:*"],"extracted_events":[{"introduced":"7.2.0-alpha1"},{"last_affected":"7.2.0-alpha1"},{"introduced":"7.2.0-beta1"},{"last_affected":"7.2.0-beta1"},{"introduced":"7.2.0-beta2"},{"last_affected":"7.2.0-beta2"},{"introduced":"7.2.0-beta3"},{"last_affected":"7.2.0-beta3"},{"introduced":"7.2.0-rc1"},{"last_affected":"7.2.0-rc1"}],"source":"CPE_STRING","vendor_product":"liferay:liferay_portal"}]},"references":[{"type":"ADVISORY","url":"https://www.liferay.com/downloads-community"},{"type":"EVIDENCE","url":"https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from"},{"type":"EVIDENCE","url":"https://sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4/"},{"type":"EVIDENCE","url":"https://www.youtube.com/watch?v=DjMEfQW3bf0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liferay/liferay-portal","events":[{"introduced":"73c2fa07b6d1ce2d0b52d290fda7c859ed3ec5d9"},{"last_affected":"469a8ab8b00358a4a3b647d3d31bd7ea9cbb0eb6"}],"database_specific":{"extracted_events":[{"introduced":"6.1.0-b1"},{"last_affected":"6.1.0-b1"},{"introduced":"6.1.0-ga1"},{"last_affected":"6.1.0-ga1"},{"introduced":"6.1.0-b2"},{"last_affected":"6.1.0-b2"},{"introduced":"6.1.0-b3"},{"last_affected":"6.1.0-b3"},{"introduced":"6.1.0-b4"},{"last_affected":"6.1.0-b4"},{"introduced":"6.1.0-rc1"},{"last_affected":"6.1.0-rc1"},{"introduced":"6.1.1-ga2"},{"last_affected":"6.1.1-ga2"},{"introduced":"6.1.2-ga3"},{"last_affected":"6.1.2-ga3"},{"introduced":"6.2.0-b1"},{"last_affected":"6.2.0-b1"},{"introduced":"6.2.0-ga1"},{"last_affected":"6.2.0-ga1"},{"introduced":"6.2.0-m1"},{"last_affected":"6.2.0-m1"},{"introduced":"6.2.0-b2"},{"last_affected":"6.2.0-b2"},{"introduced":"6.2.0-m2"},{"last_affected":"6.2.0-m2"},{"introduced":"6.2.0-m3"},{"last_affected":"6.2.0-m3"},{"introduced":"6.2.0-m4"},{"last_affected":"6.2.0-m4"},{"introduced":"6.2.0-m5"},{"last_affected":"6.2.0-m5"},{"introduced":"6.2.0-m6"},{"last_affected":"6.2.0-m6"},{"introduced":"6.2.0-rc1"},{"last_affected":"6.2.0-rc1"},{"introduced":"6.2.0-rc2"},{"last_affected":"6.2.0-rc2"},{"introduced":"6.2.0-rc3"},{"last_affected":"6.2.0-rc3"},{"introduced":"6.2.0-rc4"},{"last_affected":"6.2.0-rc4"},{"introduced":"6.2.0-rc5"},{"last_affected":"6.2.0-rc5"},{"introduced":"6.2.0-rc6"},{"last_affected":"6.2.0-rc6"},{"introduced":"6.2.1-ga2"},{"last_affected":"6.2.1-ga2"},{"introduced":"6.2.2-ga3"},{"last_affected":"6.2.2-ga3"},{"introduced":"6.2.3-ga4"},{"last_affected":"6.2.3-ga4"},{"introduced":"6.2.4-ga5"},{"last_affected":"6.2.4-ga5"},{"introduced":"6.2.5-ga6"},{"last_affected":"6.2.5-ga6"},{"introduced":"7.0.0-a1"},{"last_affected":"7.0.0-a1"},{"introduced":"7.0.0-b1"},{"last_affected":"7.0.0-b1"},{"introduced":"7.0.0-ga1"},{"last_affected":"7.0.0-ga1"},{"introduced":"7.0.0-m1"},{"last_affected":"7.0.0-m1"},{"introduced":"7.0.0-a2"},{"last_affected":"7.0.0-a2"},{"introduced":"7.0.0-b2"},{"last_affected":"7.0.0-b2"},{"introduced":"7.0.0-m2"},{"last_affected":"7.0.0-m2"},{"introduced":"7.0.0-a3"},{"last_affected":"7.0.0-a3"},{"introduced":"7.0.0-b3"},{"last_affected":"7.0.0-b3"},{"introduced":"7.0.0-m3"},{"last_affected":"7.0.0-m3"},{"introduced":"7.0.0-a4"},{"last_affected":"7.0.0-a4"},{"introduced":"7.0.0-b4"},{"last_affected":"7.0.0-b4"},{"introduced":"7.0.0-m4"},{"last_affected":"7.0.0-m4"},{"introduced":"7.0.0-a5"},{"last_affected":"7.0.0-a5"},{"introduced":"7.0.0-b5"},{"last_affected":"7.0.0-b5"},{"introduced":"7.0.0-m5"},{"last_affected":"7.0.0-m5"},{"introduced":"7.0.0-b6"},{"last_affected":"7.0.0-b6"},{"introduced":"7.0.0-m6"},{"last_affected":"7.0.0-m6"},{"introduced":"7.0.0-b7"},{"last_affected":"7.0.0-b7"},{"introduced":"7.0.0-m7"},{"last_affected":"7.0.0-m7"},{"introduced":"7.0.1-ga2"},{"last_affected":"7.0.1-ga2"},{"introduced":"7.0.2-ga3"},{"last_affected":"7.0.2-ga3"},{"introduced":"7.0.3-ga4"},{"last_affected":"7.0.3-ga4"},{"introduced":"7.0.4-ga5"},{"last_affected":"7.0.4-ga5"},{"introduced":"7.0.5-ga6"},{"last_affected":"7.0.5-ga6"},{"introduced":"7.0.6-ga7"},{"last_affected":"7.0.6-ga7"},{"introduced":"7.1.0-a1"},{"last_affected":"7.1.0-a1"},{"introduced":"7.1.0-b1"},{"last_affected":"7.1.0-b1"},{"introduced":"7.1.0-ga1"},{"last_affected":"7.1.0-ga1"},{"introduced":"7.1.0-m1"},{"last_affected":"7.1.0-m1"},{"introduced":"7.1.0-a2"},{"last_affected":"7.1.0-a2"},{"introduced":"7.1.0-b2"},{"last_affected":"7.1.0-b2"},{"introduced":"7.1.0-m2"},{"last_affected":"7.1.0-m2"},{"introduced":"7.1.0-b3"},{"last_affected":"7.1.0-b3"},{"introduced":"7.1.0-rc1"},{"last_affected":"7.1.0-rc1"},{"introduced":"7.1.1-ga2"},{"last_affected":"7.1.1-ga2"},{"introduced":"7.1.2-ga3"},{"last_affected":"7.1.2-ga3"},{"introduced":"7.1.3-ga4"},{"last_affected":"7.1.3-ga4"},{"introduced":"7.2.0-m2"},{"last_affected":"7.2.0-m2"},{"introduced":"7.2.0-rc2"},{"last_affected":"7.2.0-rc2"},{"introduced":"7.2.0-rc3"},{"last_affected":"7.2.0-rc3"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:liferay:liferay_portal:6.1.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:rc1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.3:ga4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.4:ga5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.5:ga6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.3:ga4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.4:ga5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.5:ga6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.6:ga7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:a1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:a2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:rc1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.3:ga4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:rc2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2.0:rc3:*:*:community:*:*:*"]}}],"versions":["6.1.0-b1","6.1.0-b2","6.1.0-b3","6.1.0-b4","6.1.0-rc1","6.1.1-ga2","6.1.2-ga3","6.2.0-b1","6.2.0-b2","6.2.0-m3","6.2.0-m4","6.2.0-m5","6.2.0-m6","6.2.0-rc1","6.2.0-rc2","6.2.0-rc3","6.2.0-rc4","6.2.0-rc5","6.2.0-rc6","6.2.1-ga2","6.2.2-ga3","6.2.3-ga4","6.2.4-ga5","6.2.5-ga6","7.0.0-a1","7.0.0-a2","7.0.0-a3","7.0.0-a4","7.0.0-a5","7.0.0-b6","7.0.0-b7","7.0.1-ga2","7.0.2-ga3","7.0.3-ga4","7.0.4-ga5","7.0.5-ga6","7.0.6-ga7","7.1.0-a1","7.1.0-a2","7.1.0-b3","7.1.0-rc1","7.1.1-ga2","7.1.2-ga3","7.1.3-ga4","7.2.0-m2","7.2.0-rc2","7.2.0-rc3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16891.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}