CVE-2020-9484 in Siebel Apps - Marketing
Summary
by MITRE
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
This vulnerability represents a critical remote code execution flaw in Apache Tomcat server implementations that leverages insecure deserialization practices within the session management system. The vulnerability exists in multiple major versions of Tomcat including 10.0.0-M1 through 10.0.0-M4, 9.0.0.M1 through 9.0.34, 8.5.0 through 8.5.54, and 7.0.0 through 7.0.103, making it particularly widespread across the Tomcat ecosystem. The flaw specifically targets servers configured with the PersistenceManager component that uses FileStore for session persistence, creating a dangerous attack vector when combined with weak security filtering mechanisms.
The technical exploitation requires an attacker to satisfy four critical prerequisites that together create the perfect conditions for remote code execution. First, the attacker must have the ability to control both the contents and filename of a file on the target server, effectively giving them write access to the server's file system. Second, the server must be configured with a PersistenceManager that utilizes FileStore for session data management, which is common in many production environments. Third, the PersistenceManager must be configured with sessionAttributeValueClassNameFilter set to "null" or a permissive filter that allows deserialization of attacker-controlled objects, which represents the default configuration unless a SecurityManager is properly implemented. Finally, the attacker must possess knowledge of the relative file path from the FileStore storage location to the file they control, enabling precise targeting of the deserialization process.
The operational impact of this vulnerability is severe as it allows attackers to execute arbitrary code on the target server with the privileges of the Tomcat process. This represents a complete compromise of the server's security posture, enabling attackers to access sensitive data, install backdoors, or pivot to other systems within the network. The vulnerability operates through the deserialization of Java objects, which is a well-known attack vector that has been exploited in numerous high-profile incidents. When the attacker's controlled file is deserialized by the PersistenceManager, it triggers the execution of malicious code within the server environment, bypassing traditional security controls that might otherwise prevent such attacks.
This vulnerability maps directly to CWE-502 which specifically addresses deserialization of untrusted data, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter. The attack chain follows the typical pattern of privilege escalation through server-side deserialization, where the attacker's initial foothold through file write capabilities becomes a gateway to complete system compromise. Organizations using affected Tomcat versions should immediately implement mitigations including upgrading to patched versions, implementing proper sessionAttributeValueClassNameFilter configurations, disabling unnecessary session persistence features, and ensuring that file system permissions prevent attackers from writing to critical directories. Additionally, network segmentation and monitoring for suspicious deserialization patterns should be implemented as part of a comprehensive defense strategy. The vulnerability demonstrates the critical importance of secure coding practices and proper configuration management in enterprise web applications, particularly when dealing with session management and object serialization components.