What is CVE-2020-9484?

CVE-2020-9484 is a high-severity vulnerability affecting Apache Tomcat, a widely used web server software. This vulnerability allows attackers to execute remote code by exploiting a Java deserialization issue when the PersistentManager is configured as a session manager. Systems running specific versions of Apache Tomcat and configured with a FileStore and a lax sessionAttributeValueClassNameFilter are at risk. Organizations must update their Apache Tomcat software to protect against this vulnerability.

Who is impacted by CVE-2020-9484?

CVE-2020-9484 affects users of Apache Tomcat with specific configurations. At risk are users of Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, and 7.0.0 to 7.0.103. Users of openSUSE Leap 15.1 with Tomcat installed are also affected. The vulnerability is present when the PersistentManager is configured as a session manager and allows arbitrary file uploads to the server.

What to do if CVE-2020-9484 affected you

If you're affected by the CVE-2020-9484 vulnerability, it's important to take action to protect your system. To mitigate the risk, follow these steps:

1. Upgrade to an unaffected version of Apache Tomcat

2. Disable the FileStore function

3. Configure the value of sessionAttributeValueClassNameFilter to ensure that only objects with specific attributes can be serialized/deserialized

Remember to regularly update and patch your software, and follow security best practices for server configuration and management.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-9484 vulnerability, also known as Deserialization of Untrusted Data in Apache Tomcat, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity vulnerability was published on May 20, 2020, and affects specific versions of Apache Tomcat.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-502, which involves deserialization of untrusted data in Apache Tomcat.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the National Vulnerability Database page or refer to the sources below:

• openSUSE Security Announce

• Apache Tomcat CVE-2020-9484 Proof Of Concept

• Full Disclosure: Apache Tomcat RCE via PersistentManager

• oss-security: Apache Tomcat Incomplete fix for CVE-2020-9484