CVE-2022-23307

Published Jan 18, 2022

Last updated 16 days ago

Overview

Description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Source
security@apache.org
NVD status
Modified
Products
chainsaw, log4j, reload4j, advanced_supply_chain_planning, business_intelligence, business_process_management_suite, communications_eagle_ftp_table_base_retrieval, communications_instant_messaging_server, communications_messaging_server, communications_network_integrity, communications_offline_mediation_controller, communications_unified_inventory_management, e-business_suite_cloud_manager_and_cloud_backup_module, enterprise_manager_base_platform, financial_services_revenue_management_and_billing_analytics, healthcare_foundation, hyperion_data_relationship_management, hyperion_infrastructure_technology, identity_management_suite, identity_manager_connector, jdeveloper, middleware_common_libraries_and_tools, mysql_enterprise_monitor, retail_extract_transform_and_load, tuxedo, weblogic_server

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
9
Impact score
10
Exploitability score
8
Vector string
AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

security@apache.org
CWE-502
nvd@nist.gov
CWE-502

Social media

Hype score
Not currently trending

Configurations