Deserialization in Apache Tomcat
CVE-2020-9484
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.555 (99.0th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.566 · newest: 0.555 · change: -0.011
Affected products
- Apache Tomcat — versions 9.0.0, 10.0.0
- Mcafee Epolicy Orchestrator — versions 5.9.0, 5.9.1, 5.10.0
- Oracle Agile Engineering Data Management — versions 6.2.1.0
- Oracle Agile Plm — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Agile Product Lifecycle Management — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Communications Cloud Native Core Binding Support Function — versions 1.10.0
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
- Oracle Communications Diameter Signaling Router
- Oracle Communications Element Manager
- Oracle Communications Instant Messaging Server — versions 10.0.1.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c879… (mailing-list)
- lists.debian.org/debian-lts-announce/2020/05/msg00020.html (mailing-list, Third Party Advisory)
- lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca… (mailing-list)
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a9… (mailing-list)
- lists.debian.org/debian-lts-announce/2020/05/msg00026.html (mailing-list, Third Party Advisory)
- seclists.org/fulldisclosure/2020/Jun/6 (mailing-list, Mailing List, Third Party Advisory)
- security.gentoo.org/glsa/202006-21 (vendor-advisory, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2020-9484?
- CVE-2020-9484 is a high-severity vulnerability in Apache Tomcat, classified under Deserialization of Untrusted Data. CVSS score: 7.0/10. Published 2020-05-20.
- How severe is CVE-2020-9484?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2020-9484 known to be exploited?
- 107 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.