CVE-2022-46366: falha crítica em Apache Tapestry
Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 3.7%
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache TapestryCVEs relacionadas — Apache Tapestry
No mesmo produto, das mais perigosas para as menos.
CVE-2021-27850—Bypass of the fix for CVE-2019-0195EPSS 93.6%CVE-2020-17531—Deserialization flaw in EOL Tapestry 4.EPSS 10.0%CVE-2021-30638—An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterEPSS 6.6%CVE-2022-31781—Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)EPSS 2.0%CVE-2026-61899HIGHApache Tapestry: Possible classpath file download through URL manipulationEPSS 0.7%