CVE-2022-46366

Katalog CVE

CVSS 9.8 · Critical EPSS 3,5%

Kerentanan Deserialization of Untrusted Data pada apache tapestry. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

Rincian

Terbit di NVD

2 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj issue tracking · mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/12/02/1 mailing list · advisory pihak ketiga
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md advisory pihak ketiga