CVE-2020-9484: Apache Tomcat

High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days.

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Affected products

Apache Tomcat: from 7.0.0, before 7.0.108 (fixed in 7.0.108); from 8.5.0, before 8.5.63 (fixed in 8.5.63); from 9.0.1, before 9.0.43 (fixed in 9.0.43); version 9.0.0 only; version 10.0.0 only
Canonical Ubuntu Linux: version 16.04 only; version 20.04 only
Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
Fedoraproject Fedora: version 31 only; version 32 only
McAfee Epolicy Orchestrator: version 5.9.0 only; version 5.9.1 only; version 5.10.0 only
Opensuse Leap: version 15.1 only
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Agile Product Lifecycle Management: version 9.3.3 only; version 9.3.5 only; version 9.3.6 only
Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
Oracle Communications Cloud Native Core Policy: version 1.14.0 only
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.4.0.5
Oracle Communications Element Manager: from 8.2.0, up to and including 8.2.2
Oracle Communications Instant Messaging Server: version 10.0.1.4.0 only
Oracle Communications Session Report Manager: from 8.2.0, up to and including 8.2.2
Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.2
Oracle Database: version 12.2.0.1 only; version 19c only; version 21c only
Oracle Fmw Platform: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Hospitality Guest Access: version 4.2.0 only; version 4.2.1 only
Oracle Instantis Enterprisetrack: from 17.1, up to and including 17.3
Oracle Managed File Transfer: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle MySQL Enterprise Monitor: up to and including 8.0.21
Oracle Retail Order Broker: version 15.0 only
Oracle Siebel Apps - Marketing: up to and including 21.9
Oracle Siebel UI Framework: up to and including 20.12
Oracle Transportation Management: version 6.3.7 only
and 1 more

Published 2020-05-20. Last modified 2026-10-08.