CVE-2022-23307: A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 54.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-502

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Affected products

Apache Chainsaw: before 2.1.0 — fixed in 2.1.0
Apache Log4j: from 1.2 before 2.0 — fixed in 2.0
Oracle Corporation Oracle Advanced Supply Chain Planning: 12.1, 12.2
Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
Oracle Communications Eagle Ftp Table Base Retrieval: 4.5
Oracle Communications Instant Messaging Server: 10.0.1.5.0
Oracle Communications Messaging Server: 8.1
Oracle Communications Network Integrity: 7.3.6
Oracle Communications Offline Mediation Controller: before 12.0.0.4.4; 12.0.0.5.0 — fixed in 12.0.0.4.4
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1, 7.4.2
Oracle E-Business Suite Cloud Manager And Cloud Backup Module: before 2.2.1.1.1; 2.2.1.1.1 — fixed in 2.2.1.1.1
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
Oracle Financial Services Revenue Management And Billing Analytics: 2.7.0.0, 2.7.0.1, 2.8.0.0
Oracle Healthcare Foundation: 8.1.0
Oracle Corporation Oracle Hyperion Data Relationship Management: before 11.2.8.0 — fixed in 11.2.8.0
Oracle Corporation Oracle Hyperion Infrastructure Technology: before 11.2.8.0 — fixed in 11.2.8.0
Oracle Identity Management Suite: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle Identity Manager Connector: 11.1.1.5.0
Oracle Corporation Oracle JDeveloper: 12.2.1.3.0
Oracle Middleware Common Libraries And Tools: 12.2.1.4.0
Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
Oracle Retail Extract Transform And Load: 13.2.5
Oracle Corporation Tuxedo: 12.2.2.0.0
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Qos Reload4J: before 1.2.18.1 — fixed in 1.2.18.1

How to fix

Upgrade to a fixed version: Apache Chainsaw 2.1.0; Apache Log4j 2.0; Oracle Communications Offline Mediation Controller 12.0.0.4.4; Oracle E-Business Suite Cloud Manager And Cloud Backup Module 2.2.1.1.1; Oracle Corporation Oracle Hyperion Data Relationship Management 11.2.8.0; Oracle Corporation Oracle Hyperion Infrastructure Technology 11.2.8.0; Qos Reload4J 1.2.18.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23307 or the next vulnerability affects your stack