vulnerability

Red Hat JBoss EAP: CVE-2022-23307: Deserialization of Untrusted Data

Name: Red Hat JBoss EAP: CVE-2022-23307: Deserialization of Untrusted Data
Creator: Red Hat
Published: 2022-01-18T00:00:00.000Z
Keywords: CVE, CWE-502, Red Hat JBoss EAP, 2022, 23307, Deserialization of Untrusted Data, red-hat-jboss-eap-upgrade-latest, Severity 9

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:C/I:C/A:C)

Published

Jan 18, 2022

Added

Sep 19, 2024

Modified

Mar 25, 2026

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.. A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.

Solution

red-hat-jboss-eap-upgrade-latest

References

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report