WaratekVRT Sign in

CVE-2022-23307

Affected software13 products, listed below
Severity8.8 High CVSS 3.1 3 scores
WeaknessDeserialization of untrusted data (CWE-502)
Published18 Jan 2022
Updated13 Nov 2026

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Exploitation status

Forecast only (54% 30-day chance)

No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.97% of all scored CVEs. That is a model's forecast, not a report of exploitation.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 54% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR deserial rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: deserial rule

How to mitigate CVE-2022-23307

Apply the vendor's fix. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 9.0 none AV:N/AC:L/Au:S/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2026 ↗ CPU 2026-Q2 Oracle Siebel CRM / Server Infrastructure (Apache Log4j) (17.0-25.11)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Analytics / BI Application Archive (Apache Log4j) (7.0.0.0.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1)
Oracle Siebel CRM / Siebel Core (Apache ZooKeeper) (23.5 and prior)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Utilities Applications / General (Apache Log4j) (4.2.0.3.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics BI Application Archive (Apache Log4j) 7.0.0.0.0 7.0.0.0.0
Oracle Enterprise Manager Load Testing for Web Apps (Apache Log4j) 13.3.0.1 13.3.0.1
Oracle Siebel CRM Server Infrastructure (Apache Log4j) 17.0-25.11
Oracle Siebel CRM Siebel Core (Apache ZooKeeper) 23.5 and prior
Oracle Utilities Applications General (Apache Log4j) 4.2.0.3.0 4.2.0.3.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
log4j:log4j 0 none 1.2.17
org.zenframework.z8.dependencies.commons:log4j-1.2.17 0 none 2.0

Products and versions

28 products, 41 version entries
SourceVendorProductSchemeAffected versions
nvd apache chainsaw generic ＜ 2.1.0
nvd apache log4j generic ≥ 1.2 and ＜ 2.0
osv log4j log4j generic ≤ 1.2.17
nvd oracle advanced supply chain planning generic 12.1 · 12.2
nvd oracle business intelligence generic 5.9.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd oracle business process management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle communications eagle ftp table base retrieval generic 4.5
nvd oracle communications instant messaging server generic 10.0.1.5.0
nvd oracle communications messaging server generic 8.1
nvd oracle communications network integrity generic 7.3.6
nvd oracle communications offline mediation controller generic ＜ 12.0.0.4.4 · 12.0.0.5.0
nvd oracle communications unified inventory management generic 7.4.1 · 7.4.2
nvd oracle e-business suite cloud manager and cloud backup module generic 2.2.1.1.1 · ＜ 2.2.1.1.1
nvd oracle enterprise manager base platform generic 13.4.0.0 · 13.5.0.0
nvd oracle financial services revenue management and billing analytics generic 2.7.0.0 · 2.7.0.1 · 2.8.0.0
nvd oracle healthcare foundation generic 8.1.0
nvd oracle hyperion data relationship management generic ＜ 11.2.8.0
nvd oracle hyperion infrastructure technology generic ＜ 11.2.8.0
nvd oracle identity management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle identity manager connector generic 11.1.1.5.0
nvd oracle jdeveloper generic 12.2.1.3.0
nvd oracle middleware common libraries and tools generic 12.2.1.4.0
nvd oracle mysql enterprise monitor generic ≤ 8.0.29
nvd oracle retail extract transform and load generic 13.2.5
nvd oracle tuxedo generic 12.2.2.0.0
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
osv org.zenframework.z8.dependencies.commons log4j-1.2.17 generic ≤ 2.0
nvd qos reload4j generic ＜ 1.2.18.1

References

URLTags
https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh WEB
https://logging.apache.org/log4j/1.2/index.html WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/cpujul2022.html WEB

Timeline
Published2022-01-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.