CVE-2020-9484

Fixed in a distro release EPSS 56%

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Published 2020-05-20 · CVE record · OSV

Products: apache tomcat, debian_linux, opensuse leap, fedoraproject fedora, canonical ubuntu_linux, oracle agile_engineering_data_management, oracle agile_product_lifecycle_management, oracle communications_cloud_native_core_binding_support_function, oracle communications_cloud_native_core_policy, oracle communications_diameter_signaling_router, oracle communications_element_manager, oracle communications_instant_messaging_server, oracle communications_session_report_manager, oracle communications_session_route_manager, oracle database, oracle fmw_platform, oracle hospitality_guest_access, oracle instantis_enterprisetrack, oracle managed_file_transfer, oracle mysql_enterprise_monitor, oracle retail_order_broker, oracle siebel_apps_-_marketing, oracle siebel_ui_framework, oracle transportation_management, oracle workload_manager, mcafee epolicy_orchestrator

Fixed upstream

Distro releases