CVE-2022-23307 A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
A deserialization flaw in the Chainsaw component of Log4j 1 allows attackers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23307?
CVE-2022-23307 is a high-severity unsafe deserialization vulnerability in Oracle Business Intelligence, published on 18 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Weakness: CWE-502
Which versions are affected by CVE-2022-23307?
4 open source packages ship an affected version, including log4j:log4j and org.zenframework.z8.dependencies.commons:log4j-1.2.17. It affects 26 products.
| Package | Affected | Fixed in |
|---|---|---|
log4j:log4j Maven | All versions to 1.2.17 | None |
log4j:log4j Maven | All versions to 1.2.17 | None |
org.zenframework.z8.dependencies.commons:log4j-1.2.17 Maven | All versions to 2.0 | None |
org.zenframework.z8.dependencies.commons:log4j-1.2.17 Maven | All versions to 2.0 | None |
Products include Apache Chainsaw, Apache Log4j, Oracle Advanced Supply Chain Planning, Oracle Business Intelligence, Oracle Business Process Management Suite, Oracle Communications Eagle Ftp Table Base Retrieval and 20 more.
How do I fix CVE-2022-23307?
Product is end of life, replace it.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-23307 being exploited?
There is no known exploitation of CVE-2022-23307 in the wild and no public exploit code.
Other vulnerabilities in Oracle Business Intelligence
Sources
Also known as CLEANSTART-2026-QY70985, DEBIAN-CVE-2022-23307, GHSA-f7vh-qwp3-x37m, MINI-ggh8-rwx4-vgh6, MINI-m56g-rxvp-gr3v, ROOT-APP-MAVEN-CVE-2022-23307 and 1 more.