CVE-2020-1953

CWE-20 — Improper Input Validation11 documents8 sources
Severity
10.0CRITICAL
EPSS
2.7%
top 14.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apache Apache Commons ConfigurationApache Commons ConfigurationOracle Database Server+1 more
Timeline
PublishedMar 13
Latest updateOct 15

Description

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages6 packages

▶CVEListV5apache/apache_commons_configuration5 versions+4
▶Debiancommons-configuration2< 2.7-1+3
▶NVDoracle/database_server5 versions+4

🔴Vulnerability Details

4
OSV
Remote code execution in Apache Commons Configuration↗2020-05-21
▶
GHSA
Remote code execution in Apache Commons Configuration↗2020-05-21
▶
CVEList
CVE-2020-1953: Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes↗2020-03-13
▶
OSV
CVE-2020-1953: Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes↗2020-03-13
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Health Sciences Applications Risk Matrix: Self Service Analytics (Apache Commons Configuration) — CVE-2020-1953↗2020-10-15
▶
Red Hat
apache-commons-configuration: uncontrolled class instantiation when loading YAML files↗2020-03-13
▶
Debian
CVE-2020-1953: commons-configuration2 - Apache Commons Configuration uses a third-party library to parse YAML files whic...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-1953 apache-commons-configuration2: apache-commons-configuration: uncontrolled class instantiation when loading YAML files [fedora-all]↗2020-03-19
▶
Bugzilla
CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files↗2020-03-19
▶
Bugzilla
CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files [fedora-all]↗2020-03-19
▶