When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is…

Description

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Scores

EPSS (exploitation in 30 days)

55.5% · top 1.0% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

• Remote Code Execution
• CWE-502 (opens in a new tab)All about CWE-502 and its CVEs

Affected products

• Apache Tomcat

  • affected Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-344f-f5vg-2jfj (opens in a new tab)
• Mavenorg.apache.tomcat:tomcat-catalinaGHSA-344f-f5vg-2jfj (opens in a new tab)

References (42)

• [tomcat-users] 20200521 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200523 [SECURITY] [DLA 2217-1] tomcat7 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-users] 20200524 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• openSUSE-SU-2020:0711 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• [tomcat-dev] 20200527 Re: [SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 20200602 [CVE-2020-9484] Apache Tomcat RCE via PersistentManager (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• GLSA-202006-21 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• FEDORA-2020-ce396e7d5c (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2020-d9169235a8 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://security.netapp.com/advisory/ntap-20200528-0005/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html (opens in a new tab)x_refsource_MISCx_transferred
• DSA-4727 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• USN-4448-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• [tomee-commits] 20201013 [jira] [Created] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20201013 [jira] [Updated] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20201013 [jira] [Commented] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://kc.mcafee.com/corporate/index?page=content&id=SB10332 (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-4596-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomee-commits] 20210522 [jira] [Closed] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [tomcat-users] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-users] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com//security-alerts/cpujul2021.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/security-alerts/cpujan2022.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/security-alerts/cpujul2022.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-344f-f5vg-2jfj (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-9484](https://trackcve.app/badge/CVE-2020-9484.svg)](https://trackcve.app/cve/CVE-2020-9484)

Record last updated 8 Oct 2026, 21:03 UTC.