Log in Start free

Vulnerability · Published Mar 13, 2020 · Assigned by apache

CVE-2020-1953

Critical 10.0

In plain English

A critical-severity security flaw in Apache Commons Configuration from Apache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.3% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)10.0Critical
Exploit odds (30 days)6.3%top 6.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12commons-configuration22.7-1DEBIAN-CVE-2020-1953
Debian:13commons-configuration22.7-1DEBIAN-CVE-2020-1953
Debian:14commons-configuration22.7-1DEBIAN-CVE-2020-1953
Mavenorg.apache.commons:commons-configuration22.7GHSA-7qx4-pp76-vrqh

Affected products (as reported)

VendorProductVersions
Apache Apache Commons Configuration 2.22.32.42.52.6

References