CVE-2020-9484High· 7.0▾ MidnightPoC availableWhen using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 38.5 · likelihood 11.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
57%
17 GitHub repos · Nuclei ×1
Last analysed / modified upstream
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
tomcat >= 7.0.0, < 7.0.108tomcat >= 8.5.0, < 8.5.63tomcat >= 9.0.1, < 9.0.43tomcat = 9.0.0tomcat = 10.0.0debian_linux = 8.0debian_linux = 9.0debian_linux = 10.0leap = 15.1fedora = 31fedora = 32ubuntu_linux = 16.04ubuntu_linux = 20.04agile_engineering_data_management = 6.2.1.0agile_product_lifecycle_management = 9.3.3agile_product_lifecycle_management = 9.3.5agile_product_lifecycle_management = 9.3.6communications_cloud_native_core_binding_support_function = 1.10.0communications_cloud_native_core_policy = 1.14.0communications_diameter_signaling_router >= 8.0.0.0, <= 8.4.0.5communications_element_manager >= 8.2.0, <= 8.2.2communications_instant_messaging_server = 10.0.1.4.0communications_session_report_manager >= 8.2.0, <= 8.2.2communications_session_route_manager >= 8.2.0, <= 8.2.2database = 12.2.0.1database = 19cdatabase = 21cfmw_platform = 12.2.1.3.0fmw_platform = 12.2.1.4.0hospitality_guest_access = 4.2.0hospitality_guest_access = 4.2.1instantis_enterprisetrack >= 17.1, <= 17.3managed_file_transfer = 12.2.1.3.0managed_file_transfer = 12.2.1.4.0mysql_enterprise_monitor <= 8.0.21retail_order_broker = 15.0siebel_apps_-_marketing <= 21.9siebel_ui_framework <= 20.12transportation_management = 6.3.7workload_manager = 12.2.0.1workload_manager = 18cworkload_manager = 19cepolicy_orchestrator = 5.9.0epolicy_orchestrator = 5.9.1epolicy_orchestrator = 5.10.0Upgrade past the affected range:
tomcat 9.0.43Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-25329High· 7.0The fix for CVE-2020-9484 was incomplete
CVE-2020-17527High· 7.5While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the…
CVE-2020-11996High· 7.5A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds
CVE-2017-5645Critical· 9.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitr…
CVE-2020-13935High· 7.5The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104
CVE-2016-0762Medium· 5.9The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist