CVEvulnerability

CVE-2020-9484

7.0 HIGH Published 2020-05-20 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-05-20
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Affected configurations

• apache tomcat (>= 7.0.0 < 7.0.108) • apache tomcat (>= 8.5.0 < 8.5.63) • apache tomcat (>= 9.0.1 < 9.0.43) • apache tomcat 9.0.0 • apache tomcat 10.0.0 • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • opensuse leap 15.1 • fedoraproject fedora 31 • fedoraproject fedora 32 • canonical ubuntu linux 16.04 • canonical ubuntu linux 20.04 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle communications cloud native core binding support function 1.10.0 • oracle communications cloud native core policy 1.14.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.4.0.5) • oracle communications element manager (>= 8.2.0 <= 8.2.2) • oracle communications instant messaging server 10.0.1.4.0 • oracle communications session report manager (>= 8.2.0 <= 8.2.2) • oracle communications session route manager (>= 8.2.0 <= 8.2.2) • oracle database 12.2.0.1 • oracle database 19c • oracle database 21c • oracle fmw platform 12.2.1.3.0 • oracle fmw platform 12.2.1.4.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle instantis enterprisetrack (>= 17.1 <= 17.3) • oracle managed file transfer 12.2.1.3.0 • oracle managed file transfer 12.2.1.4.0 • oracle mysql enterprise monitor (<= 8.0.21) • oracle retail order broker 15.0 • oracle siebel apps - marketing (<= 21.9) • oracle siebel ui framework (<= 20.12) • oracle transportation management 6.3.7 • oracle workload manager 12.2.0.1 • oracle workload manager 18c • oracle workload manager 19c • mcafee epolicy orchestrator 5.9.0 • mcafee epolicy orchestrator 5.9.1 • mcafee epolicy orchestrator 5.10.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References