Vulnerability · Published Jun 16, 2021 · Assigned by apache
CVE-2020-9493Java deserialization in Chainsaw
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Chainsaw from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.6%top 8.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Chainsaw | Apache Chainsaw – before 2.1.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.openwall.com/lists/oss-security/2021/06/16/1 x_refsource_MISC
- [oss-security] 20210615 CVE-2020-9493: Apache Chainsaw: Java deserialization in Chainsaw mailing-list, x_refsource_MLIST
- [announce] 20210615 CVE-2020-9493: Apache Chainsaw: Java deserialization in Chainsaw mailing-list, x_refsource_MLIST
- [oss-security] 20220118 CVE-2022-23307: Apache Log4j 1.x: A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. mailing-list, x_refsource_MLIST