CVE-2020-9493

CWE-502 — Deserialization of Untrusted Data5 documents5 sources
Severity
9.8CRITICAL
EPSS
0.3%
top 42.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apache Software Foundation Apache ChainsawApache Software Foundation Apache Log4j 1.XApache Chainsaw+2 more
Timeline
PublishedJun 16
Latest updateMay 24

Description

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5apache_software_foundation/apache_chainsawApache Chainsaw — 2.1.0
▶NVDapache/chainsaw< 2.1.0
▶CVEListV5apache_software_foundation/apache_log4j_1.x1.2.1 — unspecified+1
▶NVDapache/log4j1.2 — 2.0
▶NVDqos/reload4j< 1.2.18.1

🔴Vulnerability Details

3
GHSA
GHSA-prp9-9gxw-38j8: A deserialization flaw was found in Apache Chainsaw versions prior to 2↗2022-05-24
▶
GHSA
Deserialization of Untrusted Data in Apache Log4j↗2022-01-19
▶
CVEList
Java deserialization in Chainsaw↗2021-06-16
▶

📋Vendor Advisories

1
Red Hat
log4j: Unsafe deserialization flaw in Chainsaw log viewer↗2022-01-18
▶
CVE-2020-9493 (CRITICAL CVSS 9.8) | A deserialization flaw was found in | cvebase.io