When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.1-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-javadoc | Jul 2, 2020 | May 20, 2020 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Jul 2, 2020 | May 20, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.108Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.43Upgrade Apache Tomcat to 10.0.2Upgrade Apache Tomcat to 8.5.63 | May 21, 2020 | May 20, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 20, 2020 |
| Centos_linux | — | Upgrade tomcat6-admin-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat6Upgrade tomcat-servlet-3.0-apiUpgrade tomcat6-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat6-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-libUpgrade tomcat-docs-webapp | Jun 12, 2020 | May 20, 2020 |
| Debian | — | Upgrade tomcat9 | May 25, 2020 | May 20, 2020 |
| Freebsd | — | Upgrade tomcat9Upgrade tomcat7Upgrade tomcat85Upgrade tomcat-devel | May 24, 2020 | May 22, 2020 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Jun 16, 2020 | May 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-api | Jun 17, 2020 | May 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-api | Sep 28, 2020 | May 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-api | Sep 3, 2020 | May 20, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-api | Jul 31, 2020 | May 20, 2020 |
| Oracle Missing Cpu Apr 2021 | — | Apply the April 2021 Critical Patch Update (CPU) for Oracle Database | Sep 1, 2026 | May 20, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.55-11.4.22.0.1.69.4 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.55-11.4.22.0.1.69.4 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.55-11.4.22.0.1.69.4 on Solaris 11.4 | Jan 19, 2021 | May 20, 2020 |
| Oracle_linux | — | Upgrade tomcat6-el-2.1-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-webappsUpgrade tomcat-jsvcUpgrade tomcat6Upgrade tomcat6-jsp-2.1-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-javadocUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat6-docs-webappUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat6-lib | Jun 12, 2020 | May 20, 2020 |
| Redhat_linux | — | Upgrade tomcat6-servlet-2.5-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6Upgrade tomcat-javadocUpgrade tomcat6-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat6-webappsUpgrade tomcat-jsvcUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-libUpgrade tomcat6-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat6-docs-webappNo solution existsUpgrade tomcat-admin-webapps | Jun 12, 2020 | May 20, 2020 |
| Suse | — | Upgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat-jsvcUpgrade tomcat6Upgrade tomcat-el-3_0-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-embedUpgrade tomcat6-libUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat6-docs-webappUpgrade tomcatUpgrade tomcat6-javadocUpgrade tomcat-jsp-2_3-api | May 23, 2020 | May 20, 2020 |
| Ubuntu | — | Upgrade tomcat9-commonUpgrade tomcat9 (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat8-docs (Ubuntu Pro)Upgrade libservlet3.0-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-javaUpgrade tomcat8Upgrade tomcat9-docs (Ubuntu Pro)Upgrade libtomcat7-java (Ubuntu Pro)Upgrade tomcat7 (Ubuntu Pro)Upgrade libtomcat9-embed-javaUpgrade libtomcat8-java | Aug 5, 2020 | May 20, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub