Back to CVE records
High 7.0Published May 20, 2020
CVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
Updated under an hour ago ()
Does this affect you?
It affects apache tomcat and 25 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
- CVSS
- 7.0 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
apache tomcat apache:tomcat | from 7.0.0 before 7.0.108; from 8.5.0 before 8.5.63; from 9.0.1 before 9.0.43; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; and 26 more ranges | NVD |
debian debian_linux debian:debian_linux | 8.0; 9.0; 10.0 | NVD |
opensuse leap opensuse:leap | 15.1 | NVD |
fedoraproject fedora fedoraproject:fedora | 31; 32 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 16.04; 20.04 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.5; 9.3.6 | NVD |
oracle communications_cloud_native_core_binding_support_function oracle:communications_cloud_native_core_binding_support_function | 1.10.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.14.0 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | from 8.0.0.0 through 8.4.0.5 | NVD |
oracle communications_element_manager oracle:communications_element_manager | from 8.2.0 through 8.2.2 | NVD |
oracle communications_instant_messaging_server oracle:communications_instant_messaging_server | 10.0.1.4.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | from 8.2.0 through 8.2.2 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | from 8.2.0 through 8.2.2 | NVD |
oracle database oracle:database | 12.2.0.1; 19c; 21c | NVD |
oracle fmw_platform oracle:fmw_platform | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle hospitality_guest_access oracle:hospitality_guest_access | 4.2.0; 4.2.1 | NVD |
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack | from 17.1 through 17.3 | NVD |
oracle managed_file_transfer oracle:managed_file_transfer | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | through 8.0.21 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 15.0 | NVD |
oracle siebel_apps_-_marketing oracle:siebel_apps_-_marketing | through 21.9 | NVD |
oracle siebel_ui_framework oracle:siebel_ui_framework | through 20.12 | NVD |
oracle transportation_management oracle:transportation_management | 6.3.7 | NVD |
oracle workload_manager oracle:workload_manager | 12.2.0.1; 18c; 19c | NVD |
mcafee epolicy_orchestrator mcafee:epolicy_orchestrator | 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0 | NVD |
References
- https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2020/05/msg00020.htmlmailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.htmlvendor-advisory, x-refsource-suse
- https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2020/05/msg00026.htmlmailing-list, x-refsource-mlist
- http://seclists.org/fulldisclosure/2020/Jun/6mailing-list, x-refsource-fulldisc
- https://security.gentoo.org/glsa/202006-21vendor-advisory, x-refsource-gentoo
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/vendor-advisory, x-refsource-fedora
- https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2020/07/msg00010.htmlmailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc
- https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3Ex-refsource-misc
- https://security.netapp.com/advisory/ntap-20200528-0005/x-refsource-confirm
- http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.htmlx-refsource-misc
- https://www.debian.org/security/2020/dsa-4727vendor-advisory, x-refsource-debian
- https://usn.ubuntu.com/4448-1/vendor-advisory, x-refsource-ubuntu
- https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpuoct2020.htmlx-refsource-misc
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332x-refsource-confirm
- https://usn.ubuntu.com/4596-1/vendor-advisory, x-refsource-ubuntu
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.