GHSA-7qx4-pp76-vrqh · Severity: critical · Ecosystem: maven — Remote code execution in Apache Commons Configuration
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Conclusion & alert: CVE-2020-1953 is rated Moderate Risk (64.9/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 2.73%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-21 | 8.32% | 2.73% | -5.59% |
| 2 | 2025-11-18 | 2.73% | 8.32% | +5.59% |
| 3 | 2025-07-15 | — | 2.73% | — |
Full EPSS history (17 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 10.0 | 3.1 | CRITICAL |
|
3.9 | 6.0 | [email protected] |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-7qx4-pp76-vrqh · Severity: critical · Ecosystem: maven — Remote code execution in Apache Commons Configuration
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2020-1953 not yet assigned priority: Debian including 1 source packages (commons-configuration2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2020-1953 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2020-1953 |
ubuntu
|
medium | CVE-2020-1953 medium priority: Ubuntu including 1 source packages (commons-configuration2), 17 status rows across 17 suites (bionic, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 11, DNE 2, needed 2, ignored 1, released 1. | https://ubuntu.com/security/CVE-2020-1953 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | commons_configuration | 2.2 | cpe:2.3:a:apache:commons_configuration:2.2:*:*:*:*:*:*:* |
| apache | commons_configuration | 2.3 | cpe:2.3:a:apache:commons_configuration:2.3:*:*:*:*:*:*:* |
| apache | commons_configuration | 2.4 | cpe:2.3:a:apache:commons_configuration:2.4:*:*:*:*:*:*:* |
| apache | commons_configuration | 2.5 | cpe:2.3:a:apache:commons_configuration:2.5:*:*:*:*:*:*:* |
| apache | commons_configuration | 2.6 | cpe:2.3:a:apache:commons_configuration:2.6:*:*:*:*:*:*:* |
| oracle | database_server | 11.2.0.4 | cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:* |
| oracle | database_server | 12.1.0.2 | cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:* |
| oracle | database_server | 12.2.0.1 | cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* |
| oracle | database_server | 18c | cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* |
| oracle | database_server | 19c | cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* |
| oracle | healthcare_foundation | 7.1.1 | cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* |
| oracle | healthcare_foundation | 7.2.0 | cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* |
| oracle | healthcare_foundation | 7.2.1 | cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* |
| oracle | healthcare_foundation | 7.3.0 | cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* |