The hook
CVE-2020-9484 is a Tomcat deserialization advisory where version alone is not the whole story. The risky shape depends on an affected Tomcat release plus FileStore-backed session persistence and additional attacker-controlled file prerequisites. FixVibe keeps that distinction visible so a dependency match does not read like confirmed remote code execution.
How it works
The repo check looks for Tomcat Catalina or embedded-core Maven coordinates in Java build files, including versions referenced through local Maven properties. It also reviews Tomcat `context.xml` and `server.xml` files for PersistentManager plus FileStore session persistence. Version-only matches are reported as version-based advisories; matching configuration strengthens the posture but still does not claim runtime exploitation was proven.
The blast radius
If an affected Tomcat runtime is deployed with FileStore-backed PersistentManager session persistence and the remaining advisory prerequisites are true, attackers may be able to trigger unsafe deserialization through session loading. A repo match should drive a Tomcat upgrade, dependency-tree review, and session persistence configuration review before anyone treats it as confirmed production exposure.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade the active Tomcat release line to 7.0.104, 8.5.55, 9.0.35, 10.0.0-M5, or newer. Update direct Tomcat artifacts, BOMs, Spring Boot-managed versions, Gradle constraints, or container base images as needed. Remove FileStore-backed PersistentManager session persistence unless required; if retained, configure a strict sessionAttributeValueClassNameFilter and rebuild the deployed WAR, JAR, or image.