When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if…
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
- Public exploit codePoC-in-GitHub1 day before
- Disclosedday 0
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete once over 11 years. The latest fix listed for tomcat-catalina is 11.0.0-M11.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- same family
- same family
- same family
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Same code patched: DefaultServlet.java (machine-matched)Functions: validateGlobalXsltFilecommit 3c53c4dcommit 5c545dacommit 3aa8f28commit 4785433
This CVECVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4…20 May 2020- same family
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494.
- Stated in the CVE text
Fixes in tomcat-catalinaMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 9.0.0.M18CVE-2017-564817 Apr 2017
- 9.0.1CVE-2017-126174 Oct 2017KEV
- 9.0.17CVE-2019-022128 May 2019
- 10.0.0-M5CVE-2020-948420 May 2020
- 10.1.2CVE-2022-451433 Jan 2023
- 10.1.13CVE-2023-4108025 Aug 2023
- 11.0.0-M11CVE-2023-4658928 Nov 2023Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.apache.tomcat:tomcat-catalinaAffected: 10.0.0-M1 up to 10.0.0-M5; 9.0.0 up to 9.0.35; 8.0.0 up to 8.5.55; 7.0.0 up to 7.0.104Upgrade to 9.0.109 (older lines: 10.0.0-M5, 8.5.55, 7.0.104)
- Mavenorg.apache.tomcat.embed:tomcat-embed-coreAffected: 10.0.0-M1 up to 10.0.0-M5; 9.0.0 up to 9.0.35; 8.0.0 up to 8.5.55; 7.0.0 up to 7.0.104Upgrade to 9.0.109 (older lines: 10.0.0-M5, 8.5.94, 7.0.104)
What security researchers reported
Not named in any threat report yetAlso mentioned in 9 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Why Join The Navy When You Can Be A Pirate?24 Apr 2026
- ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 202522 Apr 2025
- invoke-mimikatz.hasthe.technology24 Dec 2024
- ACTUALIZACION | Tomcat vulnerabilities | Ubuntu security notices | Ubuntu2 Aug 2024
- IOC's found on my pesonal devices; week starting 08/14/236 Dec 2023
- IOC's found on my pesonal devices; week starting 08/14/2317 Aug 2023
- 3 more on OTX