by Kastro
Paper/Archive/CVE-2020-1953

CVE-2020-1953

Apache Apache Commons Configuration — Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the Y…

EPSS 6%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 93.6.936 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Affected

ProductAffectedFixed inSource
Apache Commons Configuration2.2–CNA
Apache Commons Configuration2.3–CNA
Apache Commons Configuration2.4–CNA
Apache Commons Configuration2.5–CNA
Apache Commons Configuration2.6–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

reflists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3Ereflists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3Ereforacle.com/security-alerts/cpuoct2020.htmlreflists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E