CVE-2022-23307
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 54.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 54.41% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- apache/chainsaw · apache/log4j · qos/reload4j · oracle/advanced supply chain planning · oracle/business intelligence · oracle/business process management suite · oracle/communications eagle ftp table base retrieval · oracle/communications instant messaging server · oracle/communications messaging server · oracle/communications network integrity · oracle/communications offline mediation controller · oracle/communications unified inventory management · oracle/e-business suite cloud manager and cloud backup module · oracle/enterprise manager base platform · oracle/financial services revenue management and billing analytics · oracle/healthcare foundation · oracle/hyperion data relationship management · oracle/hyperion infrastructure technology · oracle/identity management suite · oracle/identity manager connector · +6 more
- Source
- security@apache.org
EPSS 54.4% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhhMailing List, Vendor Advisory
- https://logging.apache.org/log4j/1.2/index.htmlVendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhhMailing List, Vendor Advisory
- https://logging.apache.org/log4j/1.2/index.htmlVendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.