When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
{
"unresolved_ranges": [
{
"extracted_events": [
{
"introduced": "8.0.0.0"
},
{
"last_affected": "8.4.0.5"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:communications_diameter_signaling_router"
},
{
"extracted_events": [
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.2"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:communications_element_manager"
},
{
"extracted_events": [
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.2"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:communications_session_report_manager"
},
{
"extracted_events": [
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.2"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:communications_session_route_manager"
},
{
"extracted_events": [
{
"introduced": "17.1"
},
{
"last_affected": "17.3"
}
],
"cpes": [
"cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:instantis_enterprisetrack"
},
{
"extracted_events": [
{
"last_affected": "8.0.21"
}
],
"cpes": [
"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:mysql_enterprise_monitor"
},
{
"extracted_events": [
{
"last_affected": "21.9"
}
],
"cpes": [
"cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:siebel_apps_-_marketing"
},
{
"extracted_events": [
{
"last_affected": "20.12"
}
],
"cpes": [
"cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*"
],
"source": "CPE_RANGE",
"vendor_product": "oracle:siebel_ui_framework"
},
{
"extracted_events": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "canonical:ubuntu_linux"
},
{
"extracted_events": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "debian:debian_linux"
},
{
"extracted_events": [
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "fedoraproject:fedora"
},
{
"extracted_events": [
{
"introduced": "5.9.0"
},
{
"last_affected": "5.9.0"
},
{
"introduced": "5.9.1"
},
{
"last_affected": "5.9.1"
},
{
"introduced": "5.10.0-NA"
},
{
"last_affected": "5.10.0-NA"
},
{
"introduced": "5.10.0-update_1"
},
{
"last_affected": "5.10.0-update_1"
},
{
"introduced": "5.10.0-update_2"
},
{
"last_affected": "5.10.0-update_2"
},
{
"introduced": "5.10.0-update_3"
},
{
"last_affected": "5.10.0-update_3"
}
],
"cpes": [
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "mcafee:epolicy_orchestrator"
},
{
"extracted_events": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "opensuse:leap"
},
{
"extracted_events": [
{
"introduced": "6.2.1.0"
},
{
"last_affected": "6.2.1.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:agile_engineering_data_management"
},
{
"extracted_events": [
{
"introduced": "9.3.3"
},
{
"last_affected": "9.3.3"
},
{
"introduced": "9.3.5"
},
{
"last_affected": "9.3.5"
},
{
"introduced": "9.3.6"
},
{
"last_affected": "9.3.6"
}
],
"cpes": [
"cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:agile_plm"
},
{
"extracted_events": [
{
"introduced": "1.10.0"
},
{
"last_affected": "1.10.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:communications_cloud_native_core_binding_support_function"
},
{
"extracted_events": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:communications_cloud_native_core_policy"
},
{
"extracted_events": [
{
"introduced": "10.0.1.4.0"
},
{
"last_affected": "10.0.1.4.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:communications_instant_messaging_server"
},
{
"extracted_events": [
{
"introduced": "12.2.0.1"
},
{
"last_affected": "12.2.0.1"
},
{
"introduced": "19c"
},
{
"last_affected": "19c"
},
{
"introduced": "21c"
},
{
"last_affected": "21c"
}
],
"cpes": [
"cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*",
"cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*",
"cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:database"
},
{
"extracted_events": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:fmw_platform"
},
{
"extracted_events": [
{
"introduced": "4.2.0"
},
{
"last_affected": "4.2.0"
},
{
"introduced": "4.2.1"
},
{
"last_affected": "4.2.1"
}
],
"cpes": [
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:hospitality_guest_access"
},
{
"extracted_events": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:managed_file_transfer"
},
{
"extracted_events": [
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
}
],
"cpes": [
"cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:retail_order_broker"
},
{
"extracted_events": [
{
"introduced": "6.3.7"
},
{
"last_affected": "6.3.7"
}
],
"cpes": [
"cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:transportation_management"
},
{
"extracted_events": [
{
"introduced": "12.2.0.1"
},
{
"last_affected": "12.2.0.1"
},
{
"introduced": "18c"
},
{
"last_affected": "18c"
},
{
"introduced": "19c"
},
{
"last_affected": "19c"
}
],
"cpes": [
"cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"vendor_product": "oracle:workload_manager"
}
]
}{
"cpe": [
"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.108"
},
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.63"
},
{
"introduced": "9.0.1"
},
{
"fixed": "9.0.43"
},
{
"introduced": "9.0.0-milestone1"
},
{
"last_affected": "9.0.0-milestone1"
},
{
"introduced": "9.0.0-milestone10"
},
{
"last_affected": "9.0.0-milestone10"
},
{
"introduced": "9.0.0-milestone11"
},
{
"last_affected": "9.0.0-milestone11"
},
{
"introduced": "9.0.0-milestone12"
},
{
"last_affected": "9.0.0-milestone12"
},
{
"introduced": "9.0.0-milestone13"
},
{
"last_affected": "9.0.0-milestone13"
},
{
"introduced": "9.0.0-milestone14"
},
{
"last_affected": "9.0.0-milestone14"
},
{
"introduced": "9.0.0-milestone15"
},
{
"last_affected": "9.0.0-milestone15"
},
{
"introduced": "9.0.0-milestone16"
},
{
"last_affected": "9.0.0-milestone16"
},
{
"introduced": "9.0.0-milestone17"
},
{
"last_affected": "9.0.0-milestone17"
},
{
"introduced": "9.0.0-milestone18"
},
{
"last_affected": "9.0.0-milestone18"
},
{
"introduced": "9.0.0-milestone19"
},
{
"last_affected": "9.0.0-milestone19"
},
{
"introduced": "9.0.0-milestone2"
},
{
"last_affected": "9.0.0-milestone2"
},
{
"introduced": "9.0.0-milestone20"
},
{
"last_affected": "9.0.0-milestone20"
},
{
"introduced": "9.0.0-milestone21"
},
{
"last_affected": "9.0.0-milestone21"
},
{
"introduced": "9.0.0-milestone22"
},
{
"last_affected": "9.0.0-milestone22"
},
{
"introduced": "9.0.0-milestone23"
},
{
"last_affected": "9.0.0-milestone23"
},
{
"introduced": "9.0.0-milestone24"
},
{
"last_affected": "9.0.0-milestone24"
},
{
"introduced": "9.0.0-milestone25"
},
{
"last_affected": "9.0.0-milestone25"
},
{
"introduced": "9.0.0-milestone26"
},
{
"last_affected": "9.0.0-milestone26"
},
{
"introduced": "9.0.0-milestone27"
},
{
"last_affected": "9.0.0-milestone27"
},
{
"introduced": "9.0.0-milestone3"
},
{
"last_affected": "9.0.0-milestone3"
},
{
"introduced": "9.0.0-milestone4"
},
{
"last_affected": "9.0.0-milestone4"
},
{
"introduced": "9.0.0-milestone5"
},
{
"last_affected": "9.0.0-milestone5"
},
{
"introduced": "9.0.0-milestone6"
},
{
"last_affected": "9.0.0-milestone6"
},
{
"introduced": "9.0.0-milestone7"
},
{
"last_affected": "9.0.0-milestone7"
},
{
"introduced": "9.0.0-milestone8"
},
{
"last_affected": "9.0.0-milestone8"
},
{
"introduced": "9.0.0-milestone9"
},
{
"last_affected": "9.0.0-milestone9"
},
{
"introduced": "10.0.0-milestone1"
},
{
"last_affected": "10.0.0-milestone1"
},
{
"introduced": "10.0.0-milestone2"
},
{
"last_affected": "10.0.0-milestone2"
},
{
"introduced": "10.0.0-milestone3"
},
{
"last_affected": "10.0.0-milestone3"
},
{
"introduced": "10.0.0-milestone4"
},
{
"last_affected": "10.0.0-milestone4"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}