Critical severity · published Mar 13, 2020
CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements
10.0
CVSS
6.3%
EPSS
No
On KEV
Description
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Commons Configuration · Apache
2.2; 2.3; 2.4; 2.5; 2.6 · source: NVD
DS
Database Server · Oracle
11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c · source: NVD
HF
Healthcare Foundation · Oracle
7.1.1; 7.2.0; 7.2.1; 7.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1953
lists.apache.org
https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
More from Commons Configuration
9.8
CVE-2022-33980
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded
7.3
CVE-2024-29131
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1
6.5
CVE-2025-46392
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x
5.4
CVE-2024-29133
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1
5.3
CVE-2026-45205
Apache Commons Configuration: StackOverflowError for YAML input with cycles