PT-2020-3309 · Apache+6 · Apache Tomcat+6
Published
2019-09-10
·
Updated
2025-12-10
·
CVE-2020-9484
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 10.0.0-M1 through 10.0.0-M4
Apache Tomcat versions 9.0.0.M1 through 9.0.34
Apache Tomcat versions 8.5.0 through 8.5.54
Apache Tomcat versions 7.0.0 through 7.0.103
Description
The issue is related to the deserialization of untrusted data in the PersistenceManager component of Apache Tomcat, which can lead to remote code execution. For the attack to succeed, an attacker must be able to control the contents and name of a file on the server, the server must be configured to use the PersistenceManager with a FileStore, the PersistenceManager must be configured with a sufficiently lax filter to allow the attacker-provided object to be deserialized, and the attacker must know the relative file path from the storage location used by FileStore to the file the attacker has control over. Using a specifically crafted request, the attacker can trigger remote code execution via deserialization of the file under their control.
Recommendations
For Apache Tomcat versions 10.0.0-M1 through 10.0.0-M4, upgrade to version 10.0.0-M5 or later.
For Apache Tomcat versions 9.0.0.M1 through 9.0.34, upgrade to version 9.0.35 or later.
For Apache Tomcat versions 8.5.0 through 8.5.54, upgrade to version 8.5.55 or later, or configure the PersistenceManager with an appropriate value for sessionAttributeValueClassNameFilter to ensure that only application-provided attributes are serialized and deserialized.
For Apache Tomcat versions 7.0.0 through 7.0.103, upgrade to version 7.0.104 or later.
Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Tomcat
Centos
Linuxmint
Red Hat
Suse
Ubuntu