CRITICAL🇵🇱 Wersja polska

CVE-2022-46366

CVSS 9.8v3.1pub. 2022-12-02upd. 2024-11-21

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Tapestry

    APP
    Apache
    3.0.0 – 4.0.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2021-27850CRITICAL9.8PL ✓same product

Apache Tapestry — RCE przez bypass filtra pobierania plików klasowych

CVE-2020-17531CRITICAL9.8PL ✓same product

Apache Tapestry 4 — deserializacja parametru 'sp' bez uwierzytelnienia

CVE-2019-0195CRITICAL9.8PL ✓same product

Apache Tapestry — RCE przez deserialization po wycieku klucza HMAC

CVE-2019-10071CRITICAL9.8PL ✓same product

Apache Tapestry — timing side channel w weryfikacji HMAC prowadzący do RCE

CVE-2026-61899HIGH7.5same product

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat...