CVE-2022-46366

Published: Dec 2, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

Affected (1)

Products: Apache: Tapestry

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Tapestry	From 3.0.0 to 4.0.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

http://www.openwall.com/lists/oss-security/2022/12/02/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/12/02/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMailing ListVendor Advisory

Timeline

No history available yet.