CVE-2020-1953
Description
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Risk Information
Base Score
10.0
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
Exploitation Probability
2.732
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple Vulnerabilities are affected in Oracle 11.2.0.4 | Windows |
| Multiple Vulnerabilities are affected in Oracle 12.1.0.2 | Windows |
| Multiple Vulnerabilities are affected in Oracle 12.2.0.1 | Windows |
| Multiple Vulnerabilities are affected in Oracle 18c | Windows |
| Multiple Vulnerabilities are affected in Oracle 19c | Windows |
| Vulnerabilities CVE-2020-1953 are fixed in Apache-commons-configuration2 2.7 | Windows |
| Multiple Vulnerabilities are affected in Oracle Database Server 19c | Windows |
| Multiple Vulnerabilities are affected in Oracle Database Server 11.2.0.4 | Windows |
| Multiple Vulnerabilities are affected in Oracle Database Server 12.1.0.2 | Windows |
| Multiple Vulnerabilities are affected in Oracle Database Server 12.2.0.1 | Windows |
| Multiple Vulnerabilities are affected in Oracle Database Server 18c | Windows |
| Vulnerabilities CVE-2020-1953 are fixed in Apache-commons-configuration2 for Linux 2.7 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234