PT-2022-27841 · Apache · Apache Tapestry

Ilyass El Hadi · Published 2022-12-02 · Updated 2024-08-03 · CVE-2022-46366

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions 3.x

Description The issue allows deserialization of untrusted data, leading to remote code execution. This problem is similar to but distinct from an issue affecting the 4.x version line. The affected version line, 3.x, is no longer supported by the maintainer.

Recommendations For Apache Tapestry versions 3.x, upgrade to a supported version line of Apache Tapestry.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-46366

GHSA-VC39-X7W6-6VJ7

Affected Products

Apache Tapestry

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-46366 · Security Note
• https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46366 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc39-x7w6-6vj7 · Vendor Advisory
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md · Note
• https://t.me/cvenotify/88785 · Telegram Post
• https://t.me/cvenotify/38962 · Telegram Post
• http://openwall.com/lists/oss-security/2022/12/02/1 · Note
• https://t.me/cibsecurity/53799 · Telegram Post