# CVE-2022-23307 Chainsaw Package

> Cascade CMS is not affected by CVE-2022-23307 — the Log4j 1.x Chainsaw deserialization issue — because the affected component is not referenced in our configuration.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2022-23307-chainsaw-package.html
category: Cascade Administration
article-type: reference
content-kind: faq
release-availability: all
tags: security
updated: 2026-10-06

> **Not affected**
>
> Neither Cascade Cloud nor on-premise distributions of Cascade CMS are affected by CVE-2022-23307. No action is required.

## What is CVE-2022-23307 (Chainsaw Package)?

In summary:

> CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

## Is Cascade CMS affected by CVE-2022-23307 (Chainsaw Package)?

No, this vulnerability does not impact Cascade Cloud or on-premise distributions of Cascade CMS. We do not reference the tools in question in our configuration, and the configuration is not exposed to users through the user interface.