CVE-2020-1953GHSA-7QX4-PP76-VRQH
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Apache Commons Configuration
2.2, 2.3, 2.4, 2.5, 2.6
- org.apache.commons:commons-configuration2Maven
From 2.2 · fixed in 2.7