Vulnerability · Published May 20, 2020 · Assigned by apache
CVE-2020-9484
High 7.0
In plain English
A high-severity security flaw in Apache Tomcat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 55.5% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.0High
Exploit odds (30 days)55.5%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tomcat9 | 9.0.35-1 | DEBIAN-CVE-2020-9484 |
| Debian:13 | tomcat9 | 9.0.35-1 | DEBIAN-CVE-2020-9484 |
| Debian:14 | tomcat9 | 9.0.35-1 | DEBIAN-CVE-2020-9484 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.35 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.0-M5 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.55 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 7.0.104 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.35 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat:tomcat-catalina | 7.0.104 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat:tomcat-catalina | 10.0.0-M5 | GHSA-344f-f5vg-2jfj |
| Maven | org.apache.tomcat:tomcat-catalina | 8.5.55 | GHSA-344f-f5vg-2jfj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Tomcat | Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103 |
References
- [tomcat-users] 20200521 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200523 [SECURITY] [DLA 2217-1] tomcat7 security update mailing-list, x_refsource_MLIST
- [tomcat-users] 20200524 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0711 vendor-advisory, x_refsource_SUSE
- [tomcat-dev] 20200527 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update mailing-list, x_refsource_MLIST
- 20200602 [CVE-2020-9484] Apache Tomcat RCE via PersistentManager mailing-list, x_refsource_FULLDISC
- GLSA-202006-21 vendor-advisory, x_refsource_GENTOO
- FEDORA-2020-ce396e7d5c vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-d9169235a8 vendor-advisory, x_refsource_FEDORA
- [tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200528-0005/ x_refsource_CONFIRM
- http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html x_refsource_MISC
- DSA-4727 vendor-advisory, x_refsource_DEBIAN
- USN-4448-1 vendor-advisory, x_refsource_UBUNTU
- [tomee-commits] 20201013 [jira] [Created] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) mailing-list, x_refsource_MLIST
- [tomee-commits] 20201013 [jira] [Updated] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) mailing-list, x_refsource_MLIST
- [tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) mailing-list, x_refsource_MLIST
- [tomee-commits] 20201013 [jira] [Commented] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332 x_refsource_CONFIRM
- USN-4596-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- [tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
- [tomcat-announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484 mailing-list, x_refsource_MLIST
- [tomee-commits] 20210522 [jira] [Closed] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- [tomcat-users] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-users] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-dev] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC