CVE-2022-23307
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
HIGH 8.8
At a glance
- Source
- NVD
- EPSS
- EPSS 54.41 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-f7vh-qwp3-x37m — Deserialization of Untrusted Data in Apache Log4j
European references
- ENISA EUVD · EUVD-2022-0575
- GCVE · GCVE-0-2022-23307
CERT-FR advisories
- CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0419 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0027 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0910 — Multiples vulnérabilités dans IBM QRadar · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0073 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-755 — Multiples vulnérabilités dans IBM Spectrum · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:chainsaw:*:*:*:*:*:*:*:*< 2.1.0cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*≥ 1.2 < 2.0cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:*< 1.2.18.1cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*< 12.0.0.4.4cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:*:*:*:*:*:*:*:*< 2.2.1.1.1cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*< 11.2.8.0cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:*< 11.2.8.0cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*≤ 8.0.29cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Log4j 1.x | affected 1.2.1 < unspecified ; affected unspecified ≤ 2.0-alpha1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |