Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-1953

27
FAUCET Score

CVE-2020-1953 is a critical vulnerability in Apache Commons Configuration versions 2.2 through 2.6, and related Oracle products, stemming from its default use of a third-party YAML parsing library that permits class instantiation. This allows an attacker to execute arbitrary code if a malicious YAML file is loaded from an untrusted source. With a CVSS score of 10.0, this vulnerability presents a critical risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, its high severity warrants immediate attention.

Impacted Technologies

VendorProductVersion(s)CPE
2.2CPE matchmatch criteria
cpe:2.3:a:apache:commons_configuration:2.2:*:*:*:*:*:*:*
2.3CPE matchmatch criteria
cpe:2.3:a:apache:commons_configuration:2.3:*:*:*:*:*:*:*
2.4CPE matchmatch criteria
cpe:2.3:a:apache:commons_configuration:2.4:*:*:*:*:*:*:*
2.5CPE matchmatch criteria
cpe:2.3:a:apache:commons_configuration:2.5:*:*:*:*:*:*:*
2.6CPE matchmatch criteria
cpe:2.3:a:apache:commons_configuration:2.6:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

10.0CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
6.68%
Probability of exploitation in next 30 days
EPSS Percentile
93.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0668 is in the 88th percentile among its peer group of 36,862 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mavenpatch availablevia ghsa
Product: org.apache.commons:commons-configuration2Fixed in: 2.7
redhatpatch availablevia redhat_api
Product: Red Hat AMQFixed in: commons-configuration2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.7.0Fixed in: commons-configuration2
View patch

Vendor Advisories (2)

mavenGHSA-7qx4-pp76-vrqhcritical

Remote code execution in Apache Commons Configuration

May 21, 2020
redhatCVE-2020-1953Important

apache-commons-configuration: uncontrolled class instantiation when loading YAML files

Mar 13, 2020

References

lists.apache.org / thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
lists.apache.org / thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E
lists.apache.org / thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E
oracle.com / security-alerts/cpuoct2020.html
Third Party Advisory