CVE-2020-9484: apache tomcat Deserialization of Untrusted Data

Modified

AliasesMGASA-2020-0277SUSE-SU-2020:1363-1SUSE-SU-2020:1364-1+11 more

Published 20-05-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-9484 is a high (CVSS 7.0) Deserialization of Untrusted Data vulnerability in apache tomcat. EPSS estimates a 55.52% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.0/10

010

High · v3.1 (NVD)

EPSS score

55.52%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 10

DLA-2209-1 DLA-2279-1 DSA-4727-1 OPENSUSE-SU-2024:11468-1 OPENSUSE-SU-2024:13441-1 SUSE-SU-2020:14375-1+7 more

Timeline

20-05-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.0v2.04.4

EPSS trend

Probability

55.52%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 55.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat57 products

jws5-tomcat< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-admin-webapps< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-docs-webapp< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-el-3.0-api< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-javadoc< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws

jws5-tomcat-jsp-2.3-api< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-lib< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-native< 0:1.2.23-5.redhat_5.el6jws | < 0:1.2.23-5.redhat_5.el7jws | < 0:1.2.23-5.redhat_5.el8jws
jws5-tomcat-native-debuginfo< 0:1.2.23-5.redhat_5.el6jws | < 0:1.2.23-5.redhat_5.el7jws | < 0:1.2.23-5.redhat_5.el8jws
jws5-tomcat-selinux< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-servlet-4.0-api< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
jws5-tomcat-webapps< 0:9.0.30-4.redhat_5.1.el6jws | < 0:9.0.30-4.redhat_5.1.el7jws | < 0:9.0.30-4.redhat_5.1.el8jws
tomcat< 0:7.0.76-12.el7_8
tomcat-admin-webapps< 0:7.0.76-12.el7_8
tomcat-docs-webapp< 0:7.0.76-12.el7_8
tomcat-el-2.2-api< 0:7.0.76-12.el7_8
tomcat-javadoc< 0:7.0.76-12.el7_8
tomcat-jsp-2.2-api< 0:7.0.76-12.el7_8
tomcat-jsvc< 0:7.0.76-12.el7_8
tomcat-lib< 0:7.0.76-12.el7_8
tomcat-native< 0:1.2.23-22.redhat_22.ep7.el6 | < 0:1.2.23-22.redhat_22.ep7.el7
tomcat-native-debuginfo< 0:1.2.23-22.redhat_22.ep7.el6 | < 0:1.2.23-22.redhat_22.ep7.el7
tomcat-servlet-3.0-api< 0:7.0.76-12.el7_8
tomcat-webapps< 0:7.0.76-12.el7_8
tomcat6< 0:6.0.24-115.el6_10
tomcat6-admin-webapps< 0:6.0.24-115.el6_10
tomcat6-docs-webapp< 0:6.0.24-115.el6_10
tomcat6-el-2.1-api< 0:6.0.24-115.el6_10
tomcat6-javadoc< 0:6.0.24-115.el6_10
tomcat6-jsp-2.1-api< 0:6.0.24-115.el6_10
tomcat6-lib< 0:6.0.24-115.el6_10
tomcat6-servlet-2.5-api< 0:6.0.24-115.el6_10
tomcat6-webapps< 0:6.0.24-115.el6_10
tomcat7< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-admin-webapps< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-docs-webapp< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-el-2.2-api< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-javadoc< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-jsp-2.2-api< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-jsvc< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-lib< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-log4j< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-selinux< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-servlet-3.0-api< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat7-webapps< 0:7.0.70-40.ep7.el6 | < 0:7.0.70-40.ep7.el7
tomcat8< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-admin-webapps< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-docs-webapp< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-el-2.2-api< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-javadoc< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-jsp-2.3-api< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-jsvc< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-lib< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-log4j< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-selinux< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-servlet-3.1-api< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7
tomcat8-webapps< 0:8.0.36-44.ep7.el6 | < 0:8.0.36-44.ep7.el7

Show all 57

Oracle20 products

agile_engineering_data_management6.2.1.0
agile_product_lifecycle_management9.3.3 | 9.3.5 | 9.3.6
communications_cloud_native_core_binding_support_function1.10.0
communications_cloud_native_core_policy1.14.0
communications_diameter_signaling_router≥ 8.0.0.0, ≤ 8.4.0.5

Show all 20

Suse9 products

tomcat&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 9.0.35-3.52.2
tomcat&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 9.0.35-3.52.2
tomcat&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP1< 9.0.35-4.30.2
tomcat&distro=SUSE Linux Enterprise Server 12 SP4< 9.0.35-3.32.1
tomcat&distro=SUSE Linux Enterprise Server 12 SP5< 9.0.35-3.32.1

Show all 9

Debian3 products

tomcat7< 7.0.56-3+really7.0.100-1+deb8u1
tomcat9< 9.0.35-1
debian_linuxEOL8.0 | 9.0 | 10.0

Ubuntu3 products

tomcat7< 7.0.52-1ubuntu0.16+esm1 | < 7.0.68-1ubuntu0.4+esm2 | < 7.0.78-1ubuntu0.1~esm1
tomcat8< 8.0.32-1ubuntu1.13 | < 8.5.39-1ubuntu1~18.04.3+esm2
tomcat9< 9.0.16-3ubuntu0.18.04.2 | < 9.0.31-1ubuntu0.1

Opensuse2 products

leapEOL15.1
tomcat&distro=openSUSE Leap 15.1< 9.0.35-lp151.3.18.1

Apache1 product

tomcatEOL≥ 7.0.0, < 7.0.108 | ≥ 8.5.0, < 8.5.63 | ≥ 9.0.1, < 9.0.43 | 9.0.0:milestone1 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone12 | 9.0.0:milestone13 | 9.0.0:milestone14 | 9.0.0:milestone15 | 9.0.0:milestone16 | 9.0.0:milestone17 | 9.0.0:milestone18 | 9.0.0:milestone19 | 9.0.0:milestone2 | 9.0.0:milestone20 | 9.0.0:milestone21 | 9.0.0:milestone22 | 9.0.0:milestone23 | 9.0.0:milestone24 | 9.0.0:milestone25 | 9.0.0:milestone26 | 9.0.0:milestone27 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9 | 10.0.0:milestone1 | 10.0.0:milestone2 | 10.0.0:milestone3 | 10.0.0:milestone4

Canonical1 product

ubuntu_linuxEOL16.04 | 20.04

Fedoraproject1 product

fedoraEOL31 | 32

Mageia1 product

tomcat< 9.0.35-1.mga7

Mcafee1 product

epolicy_orchestrator5.9.0 | 5.9.1 | 5.10.0 | 5.10.0:update_1 | 5.10.0:update_2 | 5.10.0:update_3

Org.apache.tomcat1 product

tomcat-catalina≥ 10.0.0-M1, < 10.0.0-M5 | ≥ 9.0.0, < 9.0.35 | ≥ 8.0.0, < 8.5.55 | ≥ 7.0.0, < 7.0.104

Org.apache.tomcat.embed1 product

tomcat-embed-core≥ 10.0.0-M1, < 10.0.0-M5 | ≥ 9.0.0, < 9.0.35 | ≥ 8.0.0, < 8.5.55 | ≥ 7.0.0, < 7.0.104

13 vendors · 101 products

References

115 links

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.debian.org/debian-lts-announce/2020/05/msg00020.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.htmlVendor AdvisoryX Refsource SUSEWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.debian.org/debian-lts-announce/2020/05/msg00026.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
seclists.org/fulldisclosure/2020/Jun/6Mailing ListX Refsource FULLDISCWEBThird Party Advisory
security.gentoo.org/glsa/202006-21Vendor AdvisoryX Refsource GENTOOWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA

Show all 100 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.debian.org/debian-lts-announce/2020/07/msg00010.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISCWEBPatchThird Party Advisory
lists.apache.org/thread.html/…X Refsource MISCREPORTWEBMailing ListMitigationPatchThird Party Advisory
security.netapp.com/advisory/ntap-20200528-0005/X Refsource CONFIRMThird Party Advisory
packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.htmlX Refsource MISCWEBThird Party AdvisoryVDB Entry
www.debian.org/security/2020/dsa-4727Vendor AdvisoryX Refsource DEBIANWEBThird Party Advisory
usn.ubuntu.com/4448-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISCWEBPatchThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10332X Refsource CONFIRMWEBThird Party Advisory
usn.ubuntu.com/4596-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.openwall.com/lists/oss-security/2021/03/01/2Mailing ListX Refsource MLISTWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCWEB
advisories.mageia.org/MGASA-2020-0277.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=26657REPORT
tomcat.apache.org/security-9.htmlWEBARTICLE
www.suse.com/support/update/announcement/2020/suse-su-20201363-1/Advisory
bugzilla.suse.com/1171928REPORT
www.suse.com/security/cve/CVE-2020-9484WEB
www.suse.com/support/update/announcement/2020/suse-su-20201364-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20201365-1/Advisory
access.redhat.com/errata/RHSA-2020:2483Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1838332REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2483.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-9484REPORT
www.cve.org/CVERecord?id=CVE-2020-9484AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-9484Advisory
mail-archives.apache.org/mod_mbox/…ARTICLE
tomcat.apache.org/security-10.htmlARTICLE
tomcat.apache.org/security-7.htmlARTICLE
tomcat.apache.org/security-8.htmlARTICLE
access.redhat.com/errata/RHSA-2020:2506Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2506.jsonAdvisory
access.redhat.com/errata/RHSA-2020:2529Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2529.jsonAdvisory
access.redhat.com/errata/RHSA-2020:2530Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2530.jsonAdvisory
ubuntu.com/security/CVE-2020-9484REPORT
github.com/apache/tomcat/commit/bb33048e3f9b4f2b70e4da2e6c4e34ca89023b1bREPORTWEB
github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222REPORT
github.com/apache/tomcat/commit/ec08af18d0f9ddca3f2d800ef66fe7fd20afef2fREPORT
github.com/apache/tomcat/commit/53e30390943c18fca0c9e57dbcc14f1c623cfd06REPORT
lists.apache.org/thread.html/…REPORTWEB
ubuntu.com/security/notices/USN-4448-1Advisory
ubuntu.com/security/notices/USN-4596-1Advisory
ubuntu.com/security/notices/USN-5360-1Advisory
ubuntu.com/security/notices/USN-6908-1Advisory
ubuntu.com/security/notices/USN-6943-1Advisory
security-tracker.debian.org/tracker/CVE-2020-9484Advisory
lists.opensuse.org/archives/…Advisory
github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222.patchWEB
github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453WEB
github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4WEB
github.com/apache/tomcat/commit/74b105657ffbd1d1de80455f03446c3bbf30d1f5WEB
github.com/apache/tomcat/commit/93f0cc403a9210d469afc2bd9cf03ab3251c6f35WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
usn.ubuntu.com/4596-1WEB
usn.ubuntu.com/4448-1WEB
tomcat.apache.org/security-9.htmlWEB
tomcat.apache.org/security-8.htmlWEB
tomcat.apache.org/security-7.htmlWEB
tomcat.apache.org/security-10.htmlWEB
security.netapp.com/advisory/ntap-20200528-0005WEB

Showing 100 of 115.