CVE-2020-9484
published 2022-01-27CVE-2020-9484: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to…
PriorityP261high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EXPLOIT
EPSS
56.64%
99.0th percentile
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Affected
74 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 10.0.1 – 10.0.14 | — |
| apache | tomcat | >= 7.0.0 < 7.0.108 | 7.0.108 |
| apache | tomcat | 7.0.0 – 7.0.107 | — |
| apache | tomcat | >= 8.5.0 < 8.5.63 | 8.5.63 |
| apache | tomcat | 8.5.0 – 8.5.61 | — |
| apache | tomcat | 8.5.55 – 8.5.73 | — |
| apache | tomcat | 9.0.0 – 9.0.41 | — |
| apache | tomcat | >= 9.0.1 < 9.0.43 | 9.0.43 |
| apache | tomcat | 9.0.35 – 9.0.56 | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | tomcat9 | < tomcat9 9.0.43-1 (bookworm) | tomcat9 9.0.43-1 (bookworm) |
| debian | tomcat9 | < tomcat9 9.0.35-1 (bookworm) | tomcat9 9.0.35-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
cookieJSESSIONID=../../../../../usr/local/tomcat/groovy
- →HTTP 500 response combined with body containing 'Exception', 'ObjectInputStream', and 'PersistentManagerBase' indicates successful deserialization trigger via crafted JSESSIONID cookie path traversal.
- →Exploit requires a crafted JSESSIONID cookie value containing a relative path traversal sequence pointing to an attacker-controlled file on the server (e.g., ../../../../../usr/local/tomcat/groovy). Monitor for JSESSIONID values containing path traversal sequences ('..') in HTTP request headers.
- →Attack is only exploitable when Tomcat is configured to use PersistenceManager with a FileStore and sessionAttributeValueClassNameFilter="null". Audit Tomcat configurations for this combination. ↗
- →Shodan/FOFA queries can identify exposed Apache Tomcat instances as potential targets: search for title:'Apache Tomcat' or body containing 'apache tomcat'.
- →The incomplete fix (CVE-2021-25329) means Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107 may still be vulnerable under edge-case configurations even after the CVE-2020-9484 patch. ↗
- ·All four conditions must be simultaneously true for exploitation: attacker controls a file on the server, FileStore is configured, sessionAttributeValueClassNameFilter is null or lax, and attacker knows the relative file path to their controlled file. ↗
- ·CVE-2022-23181 (TOCTOU) is only exploitable when Tomcat is configured to persist sessions using the FileStore — same prerequisite as CVE-2020-9484. ↗
- ·Red Hat Certificate System 10 and Identity Management use pki-servlet-engine with a vulnerable Tomcat version, but are not exploitable in supported configurations because PersistentManager is not set and a SecurityManager is used. ↗
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
ghsa7.0HIGH
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_apache7.0LOW
vendor_debian7.0HIGH
vendor_oracle7.0HIGH
vendor_redhat7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2024-08-01·CVSS 7.0
CVE-2020-9484 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. This issue only affected
tomcat8 for Ubuntu 18.04 LTS (CVE-2020-9484)
It was discovered that Tomcat incorrectly handled certain HTTP/2 connection
requests. A remote attacker could use this issue to obtain wrong responses
possibly containing sensitive information. This issue only affected tomcat8
for Ubuntu 18.04 LTS (CVE-2021-25122)
Thomas Wozenilek discovered that Tomcat incorrectly handled certain TLS
packets. A remote attacker could possibly use this issue to cause a denial
of service. This issue only affected
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 6.1
CVE-2021-25329 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that the Tomcat SSI printenv command echoed user
provided data without escaping it. An attacker could possibly use this
issue to perform an XSS attack. (CVE-2019-0221)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code.
(CVE-2020-9484, CVE-2021-25329)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2022-03-31·CVSS 4.3
CVE-2021-33037 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly performed input verification.
A remote attacker could possibly use this issue to intercept sensitive
information. (CVE-2020-13943, CVE-2020-17527, CVE-2021-25122, CVE-2021-30640)
It was discovered that Tomcat did not properly deserialize untrusted data.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-9484, CVE-2021-33037)
It was discovered that Tomcat did not properly validate the input length. An
attacker could possibly use this to trigger an infinite loop, resulting in a
denial of service. (CVE-2021-25329, CVE-2021-41079)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tomcat: local privilege escalation vulnerability
vendor_redhat·2022-01-26·CVSS 7.0
CVE-2022-23181 [HIGH] CWE-367 tomcat: local privilege escalation vulnerability
tomcat: local privilege escalation vulnerability
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Statement: In Red Hat Enterprise Linux 8, Red Hat Certificate System 10 and Identity Management are using the `pki-servlet-engine` component. This component embeds a version of Tomcat which is not affected by this flaw, as it does not include the fix for CVE-2020-9484. Additionally, in these specific contexts, the prerequisites to the vulnerabilit
Debian
CVE-2022-23181: tomcat9 - The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerabil...
vendor_debian·2022·CVSS 7.0
CVE-2022-23181 [HIGH] CVE-2022-23181: tomcat9 - The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerabil...
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Scope: local
bookworm: resolved (fixed in 9.0.58-1)
bullseye: resolved (fixed in 9.0.43-2~deb11u4)
forky: resolved (fixed in 9.0.58-1)
sid: resolved (fixed in 9.0.58-1)
trixie: resolved (fixed in 9.0.58-1)
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Marketing (Apache Tomcat) — CVE-2020-9484
vendor_oracle·2021-10-15·CVSS 7.0
CVE-2020-9484 [HIGH] Oracle Oracle Siebel CRM Risk Matrix: Marketing (Apache Tomcat) — CVE-2020-9484
Oracle Oracle Siebel CRM Risk Matrix: Marketing (Apache Tomcat) vulnerability
CVE: CVE-2020-9484
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Managing Messages (Apache Tomcat) — CVE-2020-9484
vendor_oracle·2021-07-15·CVSS 7.0
CVE-2020-9484 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Managing Messages (Apache Tomcat) — CVE-2020-9484
Oracle Oracle Communications Applications Risk Matrix: Managing Messages (Apache Tomcat) vulnerability
CVE: CVE-2020-9484
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2021 (JUL 2021)
Red Hat
tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
vendor_redhat·2021-03-01·CVSS 7.0
CVE-2021-25329 [HIGH] CWE-502 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Statement: In Red Hat Enterprise Linux 8, Red Hat Certificate System 10 and Identity Management are using the `pki-servlet-engine` component, which embeds a vulnerable version of Tomcat. However, in these specific contexts, the prerequisites to the vulnerability are not met. The PersistentManager
Oracle
Oracle Oracle Retail Applications Risk Matrix: System Administration (Apache Tomcat) — CVE-2020-9484
vendor_oracle·2021-01-15·CVSS 7.0
CVE-2020-9484 [HIGH] Oracle Oracle Retail Applications Risk Matrix: System Administration (Apache Tomcat) — CVE-2020-9484
Oracle Oracle Retail Applications Risk Matrix: System Administration (Apache Tomcat) vulnerability
CVE: CVE-2020-9484
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2021 (JAN 2021)
Debian
CVE-2021-25329: tomcat9 - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to ...
vendor_debian·2021·CVSS 7.0
CVE-2021-25329 [HIGH] CVE-2021-25329: tomcat9 - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to ...
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Scope: local
bookworm: resolved (fixed in 9.0.43-1)
bullseye: resolved (fixed in 9.0.43-1)
forky: resolved (fixed in 9.0.43-1)
sid: resolved (fixed in 9.0.43-1)
trixie: resolved (fixed in 9.0.43-1)
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2020-10-21·CVSS 7.5
CVE-2020-9484 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat did not properly manage HTTP/2 streams. An
attacker could possibly use this to cause Tomcat to consume resources,
resulting in a denial of service. (CVE-2020-11996)
It was discovered that Tomcat did not properly release the HTTP/1.1
processor after the upgrade to HTTP/2. An attacker could possibly use this
to generate an OutOfMemoryException, resulting in a denial of service.
(CVE-2020-13934)
It was discovered that Tomcat did not properly validate the payload length
in a WebSocket frame. An attacker could possibly use this to trigger an
infinite loop, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat did not properly deserialize untrusted da
Oracle
Oracle Oracle Communications Risk Matrix: Core (Apache Tomcat) — CVE-2020-9484
vendor_oracle·2020-10-15·CVSS 7.0
CVE-2020-9484 [HIGH] Oracle Oracle Communications Risk Matrix: Core (Apache Tomcat) — CVE-2020-9484
Oracle Oracle Communications Risk Matrix: Core (Apache Tomcat) vulnerability
CVE: CVE-2020-9484
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2020 (OCT 2020)
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2020-08-04·CVSS 7.5
CVE-2020-13935 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly validated the payload length in
a WebSocket frame. A remote attacker could possibly use this issue to cause
Tomcat to hang, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat incorrectly handled HTTP header parsing. In
certain environments where Tomcat is located behind a reverse proxy, a
remote attacker could possibly use this issue to perform HTTP Reqest
Smuggling. (CVE-2020-1935)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2020-9484)
Instructions: In general, a standard system
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache Tomcat) — CVE-2020-9484
vendor_oracle·2020-07-15·CVSS 7.0
CVE-2020-9484 [HIGH] Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache Tomcat) — CVE-2020-9484
Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache Tomcat) vulnerability
CVE: CVE-2020-9484
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2020 (JUL 2020)
Red Hat
tomcat: deserialization flaw in session persistence storage leading to RCE
vendor_redhat·2020-05-20·CVSS 7.0
CVE-2020-9484 [HIGH] CWE-502 tomcat: deserialization flaw in session persistence storage leading to RCE
tomcat: deserialization flaw in session persistence storage leading to RCE
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger r
Debian
CVE-2020-9484: tomcat9 - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8....
vendor_debian·2020·CVSS 7.0
CVE-2020-9484 [HIGH] CVE-2020-9484: tomcat9 - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8....
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. No
Apache
Apache tomcat: CVE-2020-9484
vendor_apache·CVSS 7.0
CVE-2020-9484 [LOW] Apache tomcat: CVE-2020-9484
Apache tomcat: CVE-2020-9484
CVE-2021-25329 The fix for CVE-2020-9484 was incomplete. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484 . Note that both the previously published prerequisites for CVE-2020-9484 and the previously published non-upgrade mitigations for CVE-2020-9484 also apply to this issue. This was fixed with commit 6d66e99e . This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 12 January 2021. The issue was made public on 1 March 2021. Affects: 10.0.0-M1 to 10.0.0
Severity: low
OSV
tomcat8, tomcat9 vulnerabilities
osv·2024-08-01·CVSS 7.0
CVE-2020-9484 [HIGH] tomcat8, tomcat9 vulnerabilities
tomcat8, tomcat9 vulnerabilities
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. This issue only affected
tomcat8 for Ubuntu 18.04 LTS (CVE-2020-9484)
It was discovered that Tomcat incorrectly handled certain HTTP/2 connection
requests. A remote attacker could use this issue to obtain wrong responses
possibly containing sensitive information. This issue only affected tomcat8
for Ubuntu 18.04 LTS (CVE-2021-25122)
Thomas Wozenilek discovered that Tomcat incorrectly handled certain TLS
packets. A remote attacker could possibly use this issue to cause a denial
of service. This issue only affected tomcat8 for Ubuntu 18.04 LTS
(CVE-2021-41079)
Trung
OSV
tomcat vulnerabilities
osv·2024-07-23·CVSS 6.1
CVE-2019-0221 [MEDIUM] tomcat vulnerabilities
tomcat vulnerabilities
It was discovered that the Tomcat SSI printenv command echoed user
provided data without escaping it. An attacker could possibly use this
issue to perform an XSS attack. (CVE-2019-0221)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code.
(CVE-2020-9484, CVE-2021-25329)
OSV
tomcat9 vulnerabilities
osv·2022-03-31·CVSS 4.3
CVE-2020-13943 [MEDIUM] tomcat9 vulnerabilities
tomcat9 vulnerabilities
It was discovered that Tomcat incorrectly performed input verification.
A remote attacker could possibly use this issue to intercept sensitive
information. (CVE-2020-13943, CVE-2020-17527, CVE-2021-25122, CVE-2021-30640)
It was discovered that Tomcat did not properly deserialize untrusted data.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-9484, CVE-2021-33037)
It was discovered that Tomcat did not properly validate the input length. An
attacker could possibly use this to trigger an infinite loop, resulting in a
denial of service. (CVE-2021-25329, CVE-2021-41079)
OSV
Race condition in Apache Tomcat
osv·2022-02-01·CVSS 7.0
CVE-2022-23181 [HIGH] Race condition in Apache Tomcat
Race condition in Apache Tomcat
The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
GHSA
Race condition in Apache Tomcat
ghsa·2022-02-01·CVSS 7.0
CVE-2022-23181 [HIGH] CWE-367 Race condition in Apache Tomcat
Race condition in Apache Tomcat
The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
OSV
CVE-2022-23181: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10
osv·2022-01-27·CVSS 7.0
CVE-2022-23181 [HIGH] CVE-2022-23181: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
GHSA
Potential remote code execution in Apache Tomcat
ghsa·2021-03-19·CVSS 7.0
CVE-2021-25329 [HIGH] CWE-502 Potential remote code execution in Apache Tomcat
Potential remote code execution in Apache Tomcat
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
OSV
Potential remote code execution in Apache Tomcat
osv·2021-03-19·CVSS 7.0
CVE-2021-25329 [HIGH] Potential remote code execution in Apache Tomcat
Potential remote code execution in Apache Tomcat
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
OSV
CVE-2021-25329: The fix for CVE-2020-9484 was incomplete
osv·2021-03-01·CVSS 7.0
CVE-2021-25329 [HIGH] CVE-2021-25329: The fix for CVE-2020-9484 was incomplete
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
OSV
tomcat9 vulnerabilities
osv·2020-10-21·CVSS 7.5
CVE-2020-11996 [HIGH] tomcat9 vulnerabilities
tomcat9 vulnerabilities
It was discovered that Tomcat did not properly manage HTTP/2 streams. An
attacker could possibly use this to cause Tomcat to consume resources,
resulting in a denial of service. (CVE-2020-11996)
It was discovered that Tomcat did not properly release the HTTP/1.1
processor after the upgrade to HTTP/2. An attacker could possibly use this
to generate an OutOfMemoryException, resulting in a denial of service.
(CVE-2020-13934)
It was discovered that Tomcat did not properly validate the payload length
in a WebSocket frame. An attacker could possibly use this to trigger an
infinite loop, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat did not properly deserialize untrusted data.
An attacker could possibly use this issue to execute arbit
OSV
tomcat8 vulnerabilities
osv·2020-08-04·CVSS 7.5
CVE-2020-13935 [HIGH] tomcat8 vulnerabilities
tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly validated the payload length in
a WebSocket frame. A remote attacker could possibly use this issue to cause
Tomcat to hang, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat incorrectly handled HTTP header parsing. In
certain environments where Tomcat is located behind a reverse proxy, a
remote attacker could possibly use this issue to perform HTTP Reqest
Smuggling. (CVE-2020-1935)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2020-9484)
OSV
Potential remote code execution in Apache Tomcat
osv·2020-05-21
CVE-2020-9484 [HIGH] Potential remote code execution in Apache Tomcat
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via d
GHSA
Potential remote code execution in Apache Tomcat
ghsa·2020-05-21
CVE-2020-9484 [HIGH] CWE-502 Potential remote code execution in Apache Tomcat
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via d
OSV
CVE-2020-9484: When using Apache Tomcat versions 10
osv·2020-05-20·CVSS 7.0
CVE-2020-9484 [HIGH] CVE-2020-9484: When using Apache Tomcat versions 10
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. No
Suricata
ET EXPLOIT Attempted Directory Traversal via HTTP Cookie (CVE-2020-9484)
suricata·2020-06-05·CVSS 7.0
CVE-2020-9484 [HIGH] ET EXPLOIT Attempted Directory Traversal via HTTP Cookie (CVE-2020-9484)
ET EXPLOIT Attempted Directory Traversal via HTTP Cookie (CVE-2020-9484)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Attempted Directory Traversal via HTTP Cookie (CVE-2020-9484)"; flow:established,to_server; http.cookie; content:"JSESSIONID=../"; startswith; fast_pattern; reference:url,github.com/masahiro331/CVE-2020-9484/blob/master/README.md; reference:cve,2020-9484; classtype:attempted-recon; sid:2030256; rev:2; metadata:affected_product Tomcat, created_at 2020_06_05, cve CVE_2020_9484, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory
Nuclei
Apache Tomcat Remote Command Execution
nuclei·CVSS 7.0
CVE-2020-9484 [HIGH] Apache Tomcat Remote Command Execution
Apache Tomcat Remote Command Execution
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if
a) an attacker is able to control the contents and name of a file on the server; and
b) the server is configured to use the PersistenceManager with a FileStore; and
c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and
d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserializa
Bugzilla
CVE-2022-23181 tomcat: local privilege escalation vulnerability
bugzilla·2022-01-27·CVSS 7.0
CVE-2022-23181 [HIGH] CVE-2022-23181 tomcat: local privilege escalation vulnerability
CVE-2022-23181 tomcat: local privilege escalation vulnerability
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Reference:
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Discussion:
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 2047419]
Created tomcat:master/tomcat tracking bugs for this issue:
Affects: fedora-all [bug 2047418]
---
Upstream commit:
https://github.com/apache/tomcat/commit/70da1
Bugzilla
CVE-2021-25329 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
bugzilla·2021-03-02·CVSS 7.0
CVE-2021-25329 [HIGH] CVE-2021-25329 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
CVE-2021-25329 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
The fix for CVE-2020-9484 was incomplete. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published non-upgrade mitigations for CVE-2020-9484 also apply to this issue.
Upstream commits:
Tomcat 10.0: https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
Tomcat 9.0: https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453
Tomcat 8.5: https://github.com/apache/tomcat/commit/93f0cc403a9210d469afc2bd9cf03ab3251c6f35
Tomcat 7.0: https://github.com/apache/tomcat/commit/74b105657ffbd1d1de80455f03446c3bbf30d1
Bugzilla
CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE [fedora-all]
bugzilla·2020-05-22·CVSS 7.0
CVE-2020-9484 [HIGH] CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE [fedora-all]
CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE
bugzilla·2020-05-20·CVSS 7.0
CVE-2020-9484 [HIGH] CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE
CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE
A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. An attacker can exploit the flaw if all of the following are true:
* An attacker is able to control the contents and name of a file on the server.
* The server is configured to use the PersistenceManager with a FileStore.
* The PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker-provided object to be deserialized.
* The attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over.
If all these conditions are true, the attacker can use a s
arXiv
Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation
arxiv_fulltext·2023-02-15
Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation
Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation
-5mm
Jiamou Sun1, Zhenchang Xing12, Qinghua Lu1, Xiwei Xu1, Liming Zhu13, Thong Hoang1, Dehai Zhao2
1Data61, Eveleigh, CSIRO, Sydney, Australia
2Research School of Computer Science, CECS, Australian National University, Canberra, Australia
3School of Computer Science, University of New South Wales, Sydney, Australia
-4mm
\Frank.Sun, Qinghua.Lu, Xiwei.Xu, Liming.Zhu, James.Hoang\@data61.csiro.au
\Zhenchang.Xing, Dehai.Zhao\@anu.edu.au
-4mm
## Abstract
Due to convenience, open-source software is widely used.
For beneficial reasons, open-source maintainers often fix the vulnerabilities silently, exposing their users unaware of the updates to threats.
Previous works all focus on black-box binary detect
arXiv
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
arxiv_fulltext·2022-08-17
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
[Imen Sayar]Imen Sayar^
[email protected]
University of Toulouse
Blagnac
France
31070
^ Part of this research was conducted when Imen Sayar was at the University of Luxembourg
[Alexandre Bartel]Alexandre Bartel^*
[email protected]
Umeå University
MIT-Huset
Umeå
Sweden
^*Part of this research was conducted when Alexandre Bartel was at the University of Luxembourg and the University of Copenhagen.
Eric Bodden
[email protected]
Paderborn University
Paderborn
Germany
Yves Le Traon
[email protected]
University of Luxembourg
6, rue Richard Coudenhove-Kalergi
Kirchberg Campus
Luxembourg
L-1359
## Abstract
Nowadays, an increasing number of applications uses deserializatio
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlhttps://security.netapp.com/advisory/ntap-20220217-0010/https://www.debian.org/security/2022/dsa-5265https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlhttps://security.netapp.com/advisory/ntap-20220217-0010/https://www.debian.org/security/2022/dsa-5265https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2022-01-27
Published