NetSight
IP …
high8.8

CVE-2022-23307

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.

Impact

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Affected products

VendorProductAffected versions
ApacheChainsaw
before 2.1.0
ApacheLog4j
from 1.2 before 2.0
QosReload4j
before 1.2.18.1
OracleAdvanced Supply Chain Planning
Versions 12.1, 12.2
OracleBusiness Intelligence
Versions 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Eagle Ftp Table Base Retrieval
Version 4.5
OracleCommunications Instant Messaging Server
Version 10.0.1.5.0
OracleCommunications Messaging Server
Version 8.1
OracleCommunications Network Integrity
Version 7.3.6
OracleCommunications Offline Mediation Controller
before 12.0.0.4.4
Version 12.0.0.5.0
OracleCommunications Unified Inventory Management
Versions 7.4.1, 7.4.2

Weakness classification

CWE-502

References