WaratekVRT Sign in

CVE-2020-9484 Apache Tomcat

Affected softwareApache Tomcat
Severity7.0 High CVSS 3.1 2 scores
Fixed in10.0.0-M5, 9.0.35, 8.5.55, 7.0.104
WeaknessDeserialization of untrusted data (CWE-502)
Published20 May 2020
Updated8 Oct 2026

Description

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 17 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2020-05-19.
  • EPSS 56% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
IndexArtifactStarsFirst seen
GitHub PoC tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！ 214 2020-05-19
Nuclei Apache Tomcat Remote Command Execution
GitHub PoC masahiro331/CVE-2020-9484 125 2020-05-21
GitHub PoC 用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞 52 2020-05-21
GitHub PoC PenTestical/CVE-2020-9484 35 2020-12-31
GitHub PoC Remake of CVE-2020-9484 by Pentestical 27 2024-09-16
GitHub PoC Exploit for Apache Tomcat deserialization (CVE-2020-9484) which could lead to RCE 17 2022-11-14
GitHub PoC POC for CVE-2020-9484 13 2021-02-10
GitHub PoC Apache Tomcat RCE (CVE-2020-9484) 6 2021-05-18
GitHub PoC anjai94/CVE-2020-9484-exploit 6 2020-09-05

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR deserialization security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-502: Deserialization of Untrusted Data.

How to mitigate CVE-2020-9484

Upgrade Apache Tomcat to a release that fixes it: 10.0.0-M5, 9.0.35, 8.5.55 or 7.0.104. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.0 HIGH v3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 4.4 none AV:L/AC:M/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Autonomous Health Framework / Trace File Analyzer (Apache Tomcat) (23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Siebel CRM / Marketing (Apache Tomcat) (21.9 and prior)
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Communications Applications / Managing Messages (Apache Tomcat) (10.0.1.4.0)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Retail Applications / System Administration (Apache Tomcat) (15.0)
Oracle Siebel CRM / EAI (Apache Tomcat) (20.12 and prior)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Communications / Core (Apache Tomcat) (8.0.0.0-8.4.0.5)
Oracle Communications / Core (Apache Tomcat) (8.2.0-8.2.2)
Oracle Communications / Core (Apache Tomcat) (8.2.0-8.2.2)
Oracle Communications / Core (Apache Tomcat) (8.2.0-8.2.2)
Oracle Fusion Middleware / MFT Runtime Server (Apache Tomcat) (12.2.1.3.0, 12.2.1.4.0)
Oracle Hospitality Applications / Base (Apache Tomcat) (4.2.0, 4.2.1)
Oracle Supply Chain / Install (Apache Tomcat) (6.3.7)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Construction and Engineering / Core (Apache Tomcat) (17.1-17.3)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Autonomous Health Framework Trace File Analyzer (Apache Tomcat) 23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0 25.1.0 · 25.2.0
Oracle Communications Core (Apache Tomcat) 8.0.0.0-8.4.0.5
Oracle Communications Applications Managing Messages (Apache Tomcat) 10.0.1.4.0 10.0.1.4.0
Oracle Construction and Engineering Core (Apache Tomcat) 17.1-17.3
Oracle Fusion Middleware MFT Runtime Server (Apache Tomcat) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Hospitality Applications Base (Apache Tomcat) 4.2.0, 4.2.1 4.2.0 · 4.2.1
Oracle Retail Applications System Administration (Apache Tomcat) 15.0 15.0
Oracle Siebel CRM EAI (Apache Tomcat) 20.12 and prior
Oracle Siebel CRM Marketing (Apache Tomcat) 21.9 and prior
Oracle Supply Chain Install (Apache Tomcat) 6.3.7 6.3.7

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.tomcat:tomcat-catalina 10.0.0-M1 10.0.0-M5 unbounded
org.apache.tomcat:tomcat-catalina 9.0.0 9.0.35 unbounded
org.apache.tomcat:tomcat-catalina 8.0.0 8.5.55 unbounded
org.apache.tomcat:tomcat-catalina 7.0.0 7.0.104 unbounded
org.apache.tomcat.embed:tomcat-embed-core 10.0.0-M1 10.0.0-M5 unbounded
org.apache.tomcat.embed:tomcat-embed-core 9.0.0 9.0.35 unbounded
org.apache.tomcat.embed:tomcat-embed-core 8.0.0 8.5.55 unbounded
org.apache.tomcat.embed:tomcat-embed-core 7.0.0 7.0.104 unbounded

Products and versions

28 products, 85 version entries
SourceVendorProductSchemeAffected versions
nvd apache tomcat generic ≥ 7.0.0 and ＜ 7.0.108 · ≥ 8.5.0 and ＜ 8.5.63 · 9.0.0:milestone1 · 9.0.0:milestone10 · 9.0.0:milestone11 · 9.0.0:milestone12 · 9.0.0:milestone13 · 9.0.0:milestone14 · 9.0.0:milestone15 · 9.0.0:milestone16 · 9.0.0:milestone17 · 9.0.0:milestone18 · 9.0.0:milestone19 · 9.0.0:milestone2 · 9.0.0:milestone20 · 9.0.0:milestone21 · 9.0.0:milestone22 · 9.0.0:milestone23 · 9.0.0:milestone24 · 9.0.0:milestone25 · 9.0.0:milestone26 · 9.0.0:milestone27 · 9.0.0:milestone3 · 9.0.0:milestone4 · 9.0.0:milestone5 · 9.0.0:milestone6 · 9.0.0:milestone7 · 9.0.0:milestone8 · 9.0.0:milestone9 · ≥ 9.0.1 and ＜ 9.0.43 · 10.0.0:milestone1 · 10.0.0:milestone2 · 10.0.0:milestone3 · 10.0.0:milestone4
nvd canonical ubuntu linux generic 16.04 · 20.04
nvd debian debian linux generic 8.0 · 9.0 · 10.0
nvd fedoraproject fedora generic 31 · 32
nvd mcafee epolicy orchestrator generic 5.9.0 · 5.9.1 · 5.10.0 · 5.10.0:update_1 · 5.10.0:update_2 · 5.10.0:update_3
nvd opensuse leap generic 15.1
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.5 · 9.3.6
nvd oracle communications cloud native core binding support function generic 1.10.0
nvd oracle communications cloud native core policy generic 1.14.0
nvd oracle communications diameter signaling router generic ≥ 8.0.0.0 and ≤ 8.4.0.5
nvd oracle communications element manager generic ≥ 8.2.0 and ≤ 8.2.2
nvd oracle communications instant messaging server generic 10.0.1.4.0
nvd oracle communications session report manager generic ≥ 8.2.0 and ≤ 8.2.2
nvd oracle communications session route manager generic ≥ 8.2.0 and ≤ 8.2.2
nvd oracle database generic 12.2.0.1 · 19c · 21c
nvd oracle fmw platform generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle hospitality guest access generic 4.2.0 · 4.2.1
nvd oracle instantis enterprisetrack generic ≥ 17.1 and ≤ 17.3
nvd oracle managed file transfer generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle mysql enterprise monitor generic ≤ 8.0.21
nvd oracle retail order broker generic 15.0
nvd oracle siebel apps - marketing generic ≤ 21.9
nvd oracle siebel ui framework generic ≤ 20.12
nvd oracle transportation management generic 6.3.7
nvd oracle workload manager generic 12.2.0.1 · 18c · 19c
osv org.apache.tomcat tomcat-catalina generic ≥ 7.0.0 and ＜ 7.0.104 · ≥ 8.0.0 and ＜ 8.5.55 · ≥ 9.0.0 and ＜ 9.0.35 · ≥ 10.0.0 and ＜ 10.0.0
osv org.apache.tomcat.embed tomcat-embed-core generic ≥ 7.0.0 and ＜ 7.0.104 · ≥ 8.0.0 and ＜ 8.5.55 · ≥ 9.0.0 and ＜ 9.0.35 · ≥ 10.0.0 and ＜ 10.0.0

References

URLTags
https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222.patch WEB
https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453 WEB
https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4 WEB
https://github.com/apache/tomcat/commit/74b105657ffbd1d1de80455f03446c3bbf30d1f5 WEB
https://github.com/apache/tomcat/commit/93f0cc403a9210d469afc2bd9cf03ab3251c6f35 WEB
https://github.com/apache/tomcat/commit/bb33048e3f9b4f2b70e4da2e6c4e34ca89023b1b WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N WEB

Timeline
Published2020-05-20By the CVE Program.
NVD record modified2026-10-08NVD's own last-modified date for this record.