CVE-2022-23307: A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
Vulnerability summary
CVE-2022-23307 is a high (CVSS 9.0) Deserialization of Untrusted Data vulnerability in apache software foundation apache log4j 1.x. EPSS estimates a 54.41% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 31 · Related 13Timeline
- 18-01-2022PublishedVulnerability first disclosed.
- 27-05-2026Last modifiedVulnerability information updated.
Description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
54.41%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 54.41% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle23 products
- advanced_supply_chain_planning12.1 | 12.2
- business_intelligence5.9.0.0.0 | 12.2.1.3.0 | 12.2.1.4.0
- business_process_management_suite12.2.1.3.0 | 12.2.1.4.0
- communications_eagle_ftp_table_base_retrieval4.5
- communications_instant_messaging_server10.0.1.5.0
Chainguard4 products
- druid< 35.0.1-r1 | All versions (No fix recorded)
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Apache software foundation1 product
- apache log4j 1.x≥ 1.2.1, < unspecified | ≥ unspecified, ≤ 2.0-alpha1
Debian1 product
- apache-log4j1.2< 1.2.17-11
Log4j1 product
- log4j≤ 1.2.17
Org.zenframework.z8.dependencies.commons1 product
- log4j-1.2.17≤ 2.0
Qos1 product
- reload4j< 1.2.18.1
Ubuntu1 product
- apache-log4j1.2< 1.2.17-4ubuntu3+esm2 | < 1.2.17-7ubuntu1+esm1 | < 1.2.17-8+deb10u1ubuntu0.2 | < 1.2.17-9ubuntu0.2
Wolfi1 product
- druid< 35.0.1-r1 | All versions (No fix recorded)
10 vendors · 36 products
References
12 links- lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhhX Refsource MISCREPORTWEBMailing ListVendor Advisory
