Read the docs
TI-2020-07593 Aliases CVE-2020-9484GHSA-344f-f5vg-2jfj

Deserialization of untrusted data in Apache Tomcat

Priority HIGH 66CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 24 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.5552 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-catalina (Maven): 10.0.0-M5, 9.0.35, 8.5.55 +1org.apache.tomcat.embed:tomcat-embed-core (Maven): 10.0.0-M5, 9.0.35, 8.5.55 +1Red Hat: 9 advisoriesRed Hat: 24 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache TomcatApache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103—No fix listedCNA
—org.apache.tomcat:tomcat-catalina (Maven)10.0.0-M1 to before 10.0.0-M510.0.0-M5Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat:tomcat-catalina (Maven)9.0.0 to before 9.0.359.0.35Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat:tomcat-catalina (Maven)8.0.0 to before 8.5.558.5.55Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat:tomcat-catalina (Maven)7.0.0 to before 7.0.1047.0.104Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat.embed:tomcat-embed-core (Maven)10.0.0-M1 to before 10.0.0-M510.0.0-M5Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0 to before 9.0.359.0.35Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.0.0 to before 8.5.558.5.55Patch availableGHSA-344f-f5vg-2jfj
—org.apache.tomcat.embed:tomcat-embed-core (Maven)7.0.0 to before 7.0.1047.0.104Patch availableGHSA-344f-f5vg-2jfj
  • Apache Tomcat Vendor— Affected Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M5 Fixed in 10.0.0-M5 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0 to before 9.0.35 Fixed in 9.0.35 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.0.0 to before 8.5.55 Fixed in 8.5.55 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 7.0.0 to before 7.0.104 Fixed in 7.0.104 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M5 Fixed in 10.0.0-M5 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.35 Fixed in 9.0.35 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0 to before 8.5.55 Fixed in 8.5.55 Patch available GHSA-344f-f5vg-2jfj
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.0 to before 7.0.104 Fixed in 7.0.104 Patch available GHSA-344f-f5vg-2jfj

CPE configurations NVD · 75

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.0 to before 7.0.108; 8.5.0 to before 8.5.63; 9.0.1 to before 9.0.43VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*9.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*9.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.108; 8.5.0 to before 8.5.63; 9.0.1 to before 9.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 65 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*9.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*9.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*9.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*9.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*9.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*9.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*9.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*10.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*10.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*10.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*10.0.0 milestone4VulnerableApache
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.4.0.5VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*10.0.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*19cVulnerableOracle
cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:*21cVulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.21VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*up to 21.9VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 20.12VulnerableOracle
cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*6.3.7VulnerableOracle
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*19cVulnerableOracle
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*5.10.0 update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*5.10.0 update_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*5.10.0 update_3VulnerableMcAfee
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.4.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:* Versions 10.0.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:* Versions 21c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.21 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:* Versions up to 21.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee

Remediation

  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.0.0-M5 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.35 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.55 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat:tomcat-catalina (Maven) Fixed in 7.0.104 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.0.0-M5 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.35 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.55 Advisory →
  • Fix · GHSA-344f-f5vg-2jfj org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.104 Advisory →

Red Hat 9 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:3017 Released 2020-07-27 · Red Hat rating Important
    Red Hat support for Spring Boot 2.1.15 security and bug fix update
    • Red Hat Runtimes Spring Boot 2.1.15
Show 6 more Red Hat advisories
  • RHSA-2020:2530 Released 2020-06-11 · Red Hat rating Important
    tomcat security update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-12.el7_8, tomcat-servlet-3.0-api-7.0.76-12.el7_8
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-12.el7_8, tomcat-admin-webapps-7.0.76-12.el7_8, tomcat-docs-webapp-7.0.76-12.el7_8 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-12.el7_8, tomcat-servlet-3.0-api-7.0.76-12.el7_8
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-12.el7_8, tomcat-admin-webapps-7.0.76-12.el7_8, tomcat-docs-webapp-7.0.76-12.el7_8 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-12.el7_8, tomcat-admin-webapps-7.0.76-12.el7_8, tomcat-el-2.2-api-7.0.76-12.el7_8 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-12.el7_8, tomcat-admin-webapps-7.0.76-12.el7_8, tomcat-docs-webapp-7.0.76-12.el7_8 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-12.el7_8, tomcat-admin-webapps-7.0.76-12.el7_8, tomcat-el-2.2-api-7.0.76-12.el7_8 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-12.el7_8, tomcat-javadoc-7.0.76-12.el7_8, tomcat-jsvc-7.0.76-12.el7_8
  • RHSA-2020:2529 Released 2020-06-11 · Red Hat rating Important
    tomcat6 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-115.el6_10, tomcat6-admin-webapps-6.0.24-115.el6_10, tomcat6-docs-webapp-6.0.24-115.el6_10 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-115.el6_10, tomcat6-admin-webapps-6.0.24-115.el6_10, tomcat6-docs-webapp-6.0.24-115.el6_10 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-115.el6_10, tomcat6-el-2.1-api-6.0.24-115.el6_10, tomcat6-jsp-2.1-api-6.0.24-115.el6_10 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-admin-webapps-6.0.24-115.el6_10, tomcat6-docs-webapp-6.0.24-115.el6_10, tomcat6-javadoc-6.0.24-115.el6_10 +1
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-115.el6_10, tomcat6-el-2.1-api-6.0.24-115.el6_10, tomcat6-jsp-2.1-api-6.0.24-115.el6_10 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-admin-webapps-6.0.24-115.el6_10, tomcat6-docs-webapp-6.0.24-115.el6_10, tomcat6-javadoc-6.0.24-115.el6_10 +1
  • RHSA-2020:2509 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.1 security update
    • Red Hat JBoss Web Server (JWS) 5.3
  • RHSA-2020:2506 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.1 security update
    • Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-4.redhat_5.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-4.redhat_5.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-4.redhat_5.1.el6jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-4.redhat_5.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-4.redhat_5.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-4.redhat_5.1.el7jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-4.redhat_5.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-4.redhat_5.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-4.redhat_5.1.el8jws +8
  • RHSA-2020:2487 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 9 security update
    • Red Hat JBoss Web Server 3.1
  • RHSA-2020:2483 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 9 security update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-22.redhat_22.ep7.el6, tomcat7-7.0.70-40.ep7.el6, tomcat7-admin-webapps-7.0.70-40.ep7.el6 +22
    • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-22.redhat_22.ep7.el7, tomcat7-7.0.70-40.ep7.el7, tomcat7-admin-webapps-7.0.70-40.ep7.el7 +22

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:2530
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2020:2529
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:2530
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss Web Server (JWS) 5.3Fixed RHSA-2020:2509
Red Hat JBoss Web Server 3.1Fixed RHSA-2020:2487
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2020:2483
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2020:2483
Red Hat JBoss Web Server 5.3 for RHEL 6 ServerFixed RHSA-2020:2506
Red Hat JBoss Web Server 5.3 for RHEL 7 ServerFixed RHSA-2020:2506
Red Hat JBoss Web Server 5.3 for RHEL 8Fixed RHSA-2020:2506
Red Hat Runtimes Spring Boot 2.1.15Fixed RHSA-2020:3017
Not affected: 7 products
  • Red Hat Decision Manager 7
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Process Automation 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9484
  2. 2026-10-03 Alias added: GHSA-344f-f5vg-2jfj
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → HIGH

References

Patch 8

Advisory 16

Other 56

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences