CVE-2020-9493: Java deserialization in Chainsaw
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
Other sources
Apache Chainsaw could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw when reading the log events. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-9493?
CVE-2020-9493 is a deserialization flaw found in Apache Chainsaw versions prior to 2.1.0.
How does CVE-2020-9493 pose a risk?
CVE-2020-9493 allows a remote attacker to execute arbitrary code on the system through an unsafe deserialization flaw when reading log events.
Which software versions are affected by CVE-2020-9493?
Apache Chainsaw versions prior to 2.1.0, Apache Log4j versions between 1.2 and 2.0 (inclusive), Qos Reload4j versions prior to 1.2.18.1, and IBM QRadar SIEM versions up to 7.5.0 UP7 are affected by CVE-2020-9493.
What is the severity of CVE-2020-9493?
CVE-2020-9493 has a severity rating of 9.8 (Critical).
How can CVE-2020-9493 be mitigated?
To mitigate CVE-2020-9493, update Apache Chainsaw to version 2.1.0 or later, update Apache Log4j to a version higher than 2.0, update Qos Reload4j to version 1.2.18.1 or later, and update IBM QRadar SIEM to a version higher than 7.5.0 UP7.