AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2020-9484.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSHIGH / 7CVSS 3.1 · nvd@nist.gov
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSModifiedModified Oct 08, 2026

Disclosure summary

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Source-reported weakness categories

CWE-502

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2020-9484

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

VendorProduct / associationVersion / bounds
apachetomcat* {"versionStartIncluding":"9.0.1","versionEndExcluding":"9.0.43"}
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat9.0.0
apachetomcat10.0.0
apachetomcat10.0.0
apachetomcat10.0.0
apachetomcat10.0.0
debiandebian_linux8.0
debiandebian_linux9.0
debiandebian_linux10.0
opensuseleap15.1
fedoraprojectfedora31
fedoraprojectfedora32
canonicalubuntu_linux16.04
canonicalubuntu_linux20.04
oracleagile_engineering_data_management6.2.1.0
oracleagile_product_lifecycle_management9.3.3
oracleagile_product_lifecycle_management9.3.5
oracleagile_product_lifecycle_management9.3.6
oraclecommunications_cloud_native_core_binding_support_function1.10.0
oraclecommunications_cloud_native_core_policy1.14.0
oraclecommunications_diameter_signaling_router* {"versionStartIncluding":"8.0.0.0","versionEndIncluding":"8.4.0.5"}
oraclecommunications_element_manager* {"versionStartIncluding":"8.2.0","versionEndIncluding":"8.2.2"}
oraclecommunications_instant_messaging_server10.0.1.4.0
oraclecommunications_session_report_manager* {"versionStartIncluding":"8.2.0","versionEndIncluding":"8.2.2"}
oraclecommunications_session_route_manager* {"versionStartIncluding":"8.2.0","versionEndIncluding":"8.2.2"}
oracledatabase12.2.0.1
oracledatabase19c
oracledatabase21c
oraclefmw_platform12.2.1.3.0
oraclefmw_platform12.2.1.4.0
oraclehospitality_guest_access4.2.0
oraclehospitality_guest_access4.2.1
oracleinstantis_enterprisetrack* {"versionStartIncluding":"17.1","versionEndIncluding":"17.3"}
oraclemanaged_file_transfer12.2.1.3.0
oraclemanaged_file_transfer12.2.1.4.0
oraclemysql_enterprise_monitor* {"versionEndIncluding":"8.0.21"}
oracleretail_order_broker15.0
oraclesiebel_apps_-_marketing* {"versionEndIncluding":"21.9"}
oraclesiebel_ui_framework* {"versionEndIncluding":"20.12"}
oracletransportation_management6.3.7
oracleworkload_manager12.2.0.1
oracleworkload_manager18c
oracleworkload_manager19c
mcafeeepolicy_orchestrator5.9.0
mcafeeepolicy_orchestrator5.9.1
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0

Original records & references

PUBLISHED 2020-05-20T15:15:09-04:00
MODIFIED 2026-10-08T17:17:32-04:00
INGESTED 2026-10-10T20:50:19-04:00