{"id":"CVE-2020-9484","published":"2020-05-20T18:26:41Z","modified":"2026-10-08T21:03:14Z","title":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103"]}],"description":{"text":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.5552,"percentile":0.99033,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":9,"pulses":[{"name":"Why Join The Navy When You Can Be A Pirate?","url":"https://otx.alienvault.com/pulse/69eb39604a42b712d8ed5faa","created":"2026-04-24"},{"name":"ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 2025","url":"https://otx.alienvault.com/pulse/6807e1c45dd52410facbed8f","created":"2025-04-22"},{"name":"invoke-mimikatz.hasthe.technology","url":"https://otx.alienvault.com/pulse/676af0f2663cdd2f25ed9e80","created":"2024-12-24"},{"name":"ACTUALIZACION | Tomcat vulnerabilities | Ubuntu security notices | Ubuntu","url":"https://otx.alienvault.com/pulse/66ad032749f2c0b96b5db569","created":"2024-08-02"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/65709ffcf3ffe737f8cb8dfd","created":"2023-12-06"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/64dd9c1d76a7807782a691d3","created":"2023-08-17"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab46ec79ba3a3f9f859541","created":"2023-07-09"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab412e96e4858e508978c7","created":"2023-07-09"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://seclists.org/fulldisclosure/2020/Jun/6","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://security.gentoo.org/glsa/202006-21","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200528-0005/","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://usn.ubuntu.com/4448-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10332","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5",">=9.0.0, <9.0.35",">=8.0.0, <8.5.55",">=7.0.0, <7.0.104"],"patched":["10.0.0-M5","9.0.35","8.5.55","7.0.104"],"from":["GHSA-344f-f5vg-2jfj"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5",">=9.0.0, <9.0.35",">=8.0.0, <8.5.55",">=7.0.0, <7.0.104"],"patched":["10.0.0-M5","9.0.35","8.5.55","7.0.104"],"from":["GHSA-344f-f5vg-2jfj"],"provenance":"source"}],"advisories":[{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5"],"patched":["10.0.0-M5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=9.0.0, <9.0.35"],"patched":["9.0.35"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=8.0.0, <8.5.55"],"patched":["8.5.55"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=7.0.0, <7.0.104"],"patched":["7.0.104"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5"],"patched":["10.0.0-M5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0, <9.0.35"],"patched":["9.0.35"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.0.0, <8.5.55"],"patched":["8.5.55"],"provenance":"source","from":"GHSA"},{"id":"GHSA-344f-f5vg-2jfj","url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=7.0.0, <7.0.104"],"patched":["7.0.104"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0404","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0404","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":16,"skipped":1,"earliest":"2020-05-19","earliestUrl":"https://github.com/threedr3am/tomcat-cluster-session-sync-exp","repos":[{"name":"threedr3am/tomcat-cluster-session-sync-exp","url":"https://github.com/threedr3am/tomcat-cluster-session-sync-exp","stars":214,"created":"2020-05-19"},{"name":"masahiro331/CVE-2020-9484","url":"https://github.com/masahiro331/CVE-2020-9484","stars":126,"created":"2020-05-21"},{"name":"IdealDreamLast/CVE-2020-9484","url":"https://github.com/IdealDreamLast/CVE-2020-9484","stars":52,"created":"2020-05-21"},{"name":"PenTestical/CVE-2020-9484","url":"https://github.com/PenTestical/CVE-2020-9484","stars":35,"created":"2020-12-31"},{"name":"0dayCTF/CVE-2020-9484","url":"https://github.com/0dayCTF/CVE-2020-9484","stars":25,"created":"2024-09-16"}]},"nuclei":[{"id":"CVE-2020-9484","name":"Apache Tomcat Remote Command Execution","severity":"high","path":"http/cves/2020/CVE-2020-9484.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9484.yaml"}],"first":{"date":"2020-05-19","source":"PoC-in-GitHub","url":"https://github.com/threedr3am/tomcat-cluster-session-sync-exp"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html"],"flow":[],"timeline":[{"date":"2020-05-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/threedr3am/tomcat-cluster-session-sync-exp","provenance":"source"},{"date":"2020-05-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-9484","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":27.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9903"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 16 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-traffic-server-cve-2009-2693","parents":[{"from":"CVE-2009-2693","to":"CVE-2020-9484","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/startup/ExpandWar.java","java/org/apache/catalina/startup/HostConfig.java"],"commits":["https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6","https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453"],"basis":"shared function","functions":["expand","fixDocBase"]}]},{"from":"CVE-2009-2901","to":"CVE-2020-9484","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/startup/ExpandWar.java","java/org/apache/catalina/startup/HostConfig.java"],"commits":["https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6","https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453"],"basis":"shared function","functions":["expand","fixDocBase"]}]},{"from":"CVE-2009-2902","to":"CVE-2020-9484","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/startup/ExpandWar.java","java/org/apache/catalina/startup/HostConfig.java"],"commits":["https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6","https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453"],"basis":"shared function","functions":["expand","fixDocBase"]}]},{"from":"CVE-2014-0096","to":"CVE-2020-9484","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/servlets/DefaultServlet.java"],"commits":["https://github.com/apache/tomcat/commit/3c53c4da7bcf300f519eaed5ad1751d24dd59f6b","https://github.com/apache/tomcat/commit/5c545da226b3c71ed9603c38ad2de88057778c1b","https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453"],"basis":"shared function","functions":["validateGlobalXsltFile"]}]}],"children":[{"from":"CVE-2020-9484","to":"CVE-2021-25329","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The fix for CVE-2020-9484 was incomplete.","from":"CVE.org","in":"CVE-2021-25329"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/servlets/DefaultServlet.java","java/org/apache/catalina/session/FileStore.java","java/org/apache/catalina/startup/ExpandWar.java","java/org/apache/catalina/startup/HostConfig.java"],"commits":["https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453","https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4"],"basis":"shared function","functions":["deployDescriptor","expand","file","fixDocBase","validate"]}]}],"packageHistory":[{"cve":"CVE-2017-5648","published":"2017-04-17","fixed":"9.0.0.M18","kev":false},{"cve":"CVE-2017-12617","published":"2017-10-04","fixed":"9.0.1","kev":true},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false,"link":{"from":"CVE-2019-0221","to":"CVE-2020-9484","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.17","toFixed":"9.0.35","daysApart":358},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.94","toFixed":"7.0.104","daysApart":358}]}},{"cve":"CVE-2020-9484","published":"2020-05-20","fixed":"10.0.0-M5","kev":false},{"cve":"CVE-2022-45143","published":"2023-01-03","fixed":"10.1.2","kev":false},{"cve":"CVE-2023-41080","published":"2023-08-25","fixed":"10.1.13","kev":false},{"cve":"CVE-2023-46589","published":"2023-11-28","fixed":"11.0.0-M11","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-catalina"}}