CVE-2019-16891: Liferay Portal RCE Vulnerability via JSON Deserialization
Summary
CVE-2019-16891: Liferay Portal Allows RCE via Deserialization of a JSON Payload. Affects com.liferay.portal:release.portal.bom versions < 7.1.1. Fixed in 7.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source enterprise portal framework that provides a platform for building web applications and managing content. It is widely used for its robust features, including user management, content management, and collaboration tools. However, versions 7.1.0 and earlier are vulnerable to a critical security flaw that allows remote command execution due to improper handling of JSON payloads.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted JSON data, which can be exploited by an attacker to execute arbitrary commands on the server. This can lead to unauthorized access, data breaches, and complete system compromise. The flaw is classified under CWE-502, indicating a risk associated with deserialization of untrusted data. The severity of this vulnerability is critical, with a CVSS score of 9.8, highlighting the potential impact on affected systems.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict input validation and sanitization for JSON payloads to mitigate the risk of deserialization attacks. Additionally, restrict access to the application to trusted users only.
Conclusion
The CVE-2019-16891 vulnerability poses a significant risk to Liferay Portal users, allowing remote command execution through JSON deserialization. It is crucial to update to the patched version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2019-16891 is a critical vulnerability in Liferay Portal that allows remote command execution due to improper deserialization of JSON payloads.
Liferay Portal versions 7.1.0 and earlier are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
It is recommended to update to Liferay Portal version 7.1.1 or later to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
