Deserialization in Apache Tomcat
CVE-2020-9484
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Vulnerability class: Insecure Deserialization
EPSS: 0.566 (99.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Tomcat — versions 9.0.0, 10.0.0
- Mcafee Epolicy_orchestrator — versions 5.9.0, 5.9.1, 5.10.0
- Oracle Agile_engineering_data_management — versions 6.2.1.0
- Oracle Agile_plm — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Agile_product_lifecycle_management — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Communications_cloud_native_core_binding_support_function — versions 1.10.0
- Oracle Communications_cloud_native_core_policy — versions 1.14.0
- Oracle Communications_diameter_signaling_router
- Oracle Communications_element_manager
- Oracle Communications_instant_messaging_server — versions 10.0.1.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@apache.org (x_refsource_FEDORA, vendor-advisory)
- security@apache.org (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2020-9484?
- CVE-2020-9484 is a high-severity vulnerability in Apache Tomcat, classified under Deserialization of Untrusted Data. CVSS score: 7.0/10. Published 2020-05-20.
- How severe is CVE-2020-9484?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2020-9484 known to be exploited?
- 107 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.