--- title: "CVE-2020-9484: Apache Tomcat vulnerability | CubePath" description: "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control…" language: en source: https://cubepath.com/security/cve/CVE-2020-9484 --- # CVE-2020-9484: Apache Tomcat vulnerability | CubePath ## Description When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. Official description from the CVE record, published by apache. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2020-9484) ## Key data ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.55520 (55.5% probability) Percentile 99.0% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA assessment as of Oct 8, 2026 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Automatable no Technical impact total ## Affected products Products listed in the CVE record, as the CNA published them. - Apache Tomcat - affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103 ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [\[tomcat-users\] 20200521 Re: \[SECURITY\] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence](https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[debian-lts-announce\] 20200523 \[SECURITY\] \[DLA 2217-1\] tomcat7 security update](https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html) (lists.debian.org) mailing-list - [\[tomcat-users\] 20200524 Re: \[SECURITY\] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence](https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [openSUSE-SU-2020:0711](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html) (lists.opensuse.org) vendor-advisory - [\[tomcat-dev\] 20200527 Re: \[SECURITY\] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence](https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[debian-lts-announce\] 20200528 \[SECURITY\] \[DLA 2209-1\] tomcat8 security update](https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html) (lists.debian.org) mailing-list - [20200602 \[CVE-2020-9484\] Apache Tomcat RCE via PersistentManager](http://seclists.org/fulldisclosure/2020/Jun/6) (seclists.org) mailing-list - [GLSA-202006-21](https://security.gentoo.org/glsa/202006-21) (security.gentoo.org) vendor-advisory - [FEDORA-2020-ce396e7d5c](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/) (lists.fedoraproject.org) vendor-advisory - [FEDORA-2020-d9169235a8](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/) (lists.fedoraproject.org) vendor-advisory - [\[tomcat-dev\] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml](https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[debian-lts-announce\] 20200712 \[SECURITY\] \[DLA 2279-1\] tomcat8 security update](https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html) (lists.debian.org) mailing-list - [oracle.com/security-alerts/cpujul2020.html](https://www.oracle.com/security-alerts/cpujul2020.html) - [lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17…](https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E) - [security.netapp.com/advisory/ntap-20200528-0005](https://security.netapp.com/advisory/ntap-20200528-0005/) - [packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020…](http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html) - [DSA-4727](https://www.debian.org/security/2020/dsa-4727) (debian.org) vendor-advisory - [USN-4448-1](https://usn.ubuntu.com/4448-1/) (usn.ubuntu.com) vendor-advisory - [\[tomee-commits\] 20201013 \[jira\] \[Created\] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)](https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E) (lists.apache.org) mailing-list - [\[tomee-commits\] 20201013 \[jira\] \[Updated\] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)](https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E) (lists.apache.org) mailing-list - [\[tomee-commits\] 20201013 \[jira\] \[Assigned\] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)](https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E) (lists.apache.org) mailing-list - [\[tomee-commits\] 20201013 \[jira\] \[Commented\] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)](https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com/security-alerts/cpuoct2020.html](https://www.oracle.com/security-alerts/cpuoct2020.html) - [kc.mcafee.com/corporate/index?page=content&id=SB10332](https://kc.mcafee.com/corporate/index?page=content&id=SB10332) - [USN-4596-1](https://usn.ubuntu.com/4596-1/) (usn.ubuntu.com) vendor-advisory - [oracle.com/security-alerts/cpujan2021.html](https://www.oracle.com/security-alerts/cpujan2021.html) - [\[tomcat-dev\] 20210301 \[SECURITY\] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)](https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[announce\] 20210301 \[SECURITY\] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)](https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-users\] 20210301 \[SECURITY\] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)](https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-dev\] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml](https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-announce\] 20210301 \[SECURITY\] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)](https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[oss-security\] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484](http://www.openwall.com/lists/oss-security/2021/03/01/2) (openwall.com) mailing-list - [\[tomee-commits\] 20210522 \[jira\] \[Closed\] (TOMEE-2909) Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)](https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com/security-alerts/cpuApr2021.html](https://www.oracle.com/security-alerts/cpuApr2021.html) - [\[tomcat-users\] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5](https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-users\] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5](https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-users\] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5](https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [\[tomcat-dev\] 20210712 svn commit: r1891484 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml](https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com//security-alerts/cpujul2021.html](https://www.oracle.com//security-alerts/cpujul2021.html) - [oracle.com/security-alerts/cpuoct2021.html](https://www.oracle.com/security-alerts/cpuoct2021.html) - [oracle.com/security-alerts/cpujan2022.html](https://www.oracle.com/security-alerts/cpujan2022.html) - [oracle.com/security-alerts/cpujul2022.html](https://www.oracle.com/security-alerts/cpujul2022.html) ## Timeline 1. ID reserved Mar 1, 2020 2. Record published May 20, 2020 3. Record last updated Oct 8, 2026 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 20:00 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)