Skip to content
Fencer Vulns
critical 10.0

CVE-2020-1953 in the critical feed json

Remote code execution in Apache Commons Configuration

published 2020-03-13 6 y ago modified 2026-06-17 4 mo ago also GHSA-7qx4-pp76-vrqh , EUVD-2020-0415

cvss
10.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.3%
EPSS 6.3% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Patch / fix

  • maven org.apache.commons:commons-configuration2 2.7
  • commons-configuration2 Debian 14, Debian 13, Debian 12 2.7-1

debian advisories DEBIAN-CVE-2020-1953

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1953 updated cvss 9.0

apache-commons-configuration: uncontrolled class instantiation when loading YAML files

  • Red Hat JBoss BRMS 5 commons-configuration Red Hat JBoss SOA Platform 5 commons-configuration
    affected: workaround, no fix planned “There is currently no mitigation available for this vulnerability.”
  • Red Hat AMQ
    fixed: vendor fix “There is currently no mitigation available for this vulnerability.” RHSA-2020:2751
  • Red Hat Fuse 7.7.0
    fixed: vendor fix “There is currently no mitigation available for this vulnerability.” RHSA-2020:3192
  • Red Hat A-MQ Clients 2 commons-configuration2 Red Hat A-MQ Online commons-configuration2 Red Hat BPM Suite 6 commons-configuration Red Hat Decision Manager 7 commons-configuration Red Hat Enterprise Linux 7 apache-commons-configuration, apache-commons-configuration-javadoc Red Hat JBoss BRMS 6 commons-configuration
    +10 more products
    Red Hat JBoss Data Grid 7 commons-configuration2 Red Hat JBoss Enterprise Application Platform 6 commons-configuration Red Hat JBoss Enterprise Application Platform 7 commons-configuration2 Red Hat JBoss Fuse 6 commons-configuration Red Hat JBoss Fuse Service Works 6 commons-configuration Red Hat OpenShift Application Runtimes commons-configuration Red Hat Process Automation 7 commons-configuration Red Hat Software Collections rh-maven35-apache-commons-configuration Red Hat Storage 3 commons-configuration Red Hat Virtualization 4 apache-commons-configuration
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.32% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.commons:commons-configuration2
>=2.2, <2.7
2.7

Affected products

  • Apache Apache Commons Configuration

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.