Medium severity · published Apr 27, 2020
CVE-2020-9489
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser
5.5
CVSS
2.7%
EPSS
No
On KEV
Description
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
FP
Flexcube Private Banking · Oracle
12.0.0; 12.1.0 · source: NVD
PU
Primavera Unifier · Oracle
17.7 through 17.12; 16.1; 16.2; 18.8; 19.12 · source: NVD
TI
Tika · Apache
1.24 · source: NVD
WP
Webcenter Portal · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9489
lists.apache.org
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E
Patch
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
https://www.oracle.com/security-alerts/cpuoct2020.html
More from Tika
9.8
CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
9.8
CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML…
9.8
CVE-2016-6809
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files
8.8
CVE-2019-10088
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21
8.4
CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection…