VDB
RHSA-2020%3A2509
RHSA-2020%3A2509
PUBLISHED
CVSS 7 HIGH
A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization of the file under their control. The highest threat from the vulnerability is to data confidentiality and integrity as well as system availability.
Risk Scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Web Server (JWS) 5.3 |
Timeline
- Jun 10, 2020 CVE Published
- May 1, 2026 Distribution Patch
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.3/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2509.json advisory
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202005.mbox/%3Ce3a0a517-bf82-ba62-0af6-24b83ea0e4e2%40apache.org%3E advisory
- http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M5 advisory
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.104 advisory
- https://access.redhat.com/errata/RHSA-2020:2509 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=5.3 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1838332 issue
- https://access.redhat.com/security/cve/CVE-2020-9484 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-9484 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-9484 advisory
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.55 advisory
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.35 advisory