CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-23307
High (8.8). EPSS 54% chance of exploitation in the next 30 days.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Severity
- EPSS
- 54% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:chainsaw
- apache:log4j
- oracle:advanced_supply_chain_planning
- oracle:business_intelligence
- oracle:business_process_management_suite
- oracle:communications_eagle_ftp_table_base_retrieval
- oracle:communications_instant_messaging_server
- oracle:communications_messaging_server
- oracle:communications_network_integrity
- oracle:communications_offline_mediation_controller
- oracle:communications_unified_inventory_management
- oracle:e-business_suite_cloud_manager_and_cloud_backup_module
- oracle:enterprise_manager_base_platform
- oracle:financial_services_revenue_management_and_billing_analytics
- oracle:healthcare_foundation
- oracle:hyperion_data_relationship_management
- oracle:hyperion_infrastructure_technology
- oracle:identity_management_suite
- oracle:identity_manager_connector
- oracle:jdeveloper
- oracle:middleware_common_libraries_and_tools
- oracle:mysql_enterprise_monitor
- oracle:retail_extract_transform_and_load
- oracle:tuxedo
- oracle:weblogic_server
- qos:reload4j
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f7vh-qwp3-x37m | Maven | log4j:log4j | <=1.2.17 | no fix published |
| GHSA-f7vh-qwp3-x37m | Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | <=2.0 | no fix published |