CVE Feed

    Dashboard / CVE / CVE-2022-46366

    CVE-2022-46366

    Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

    Published:Dec 2, 2022
    Last Modified:Nov 21, 2024
    EPS:Dec 2, 2022
    EPSS Score:0.03757
    CVSS Score:9.8

    Affected Products

    Vendor
    Apache
    Product
    Tapestry

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2026-61899 (CVSS 7.5) — Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat…
    CVE-2022-31781 (CVSS 7.5) — Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way i…
    CVE-2021-30638 (CVSS 7.5) — Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download…
    CVE-2021-27850 (CVSS 9.8) — A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestr…
    CVE-2020-17531 (CVSS 9.8) — A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deseriali…
    CVE-2020-13953 (CVSS 5.3) — In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-…
    CVE-2019-10071 (CVSS 9.8) — The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing…
    CVE-2019-0207 (CVSS 7.5) — Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextRe…
    CVE-2019-0195 (CVSS 9.8) — Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and …
    CVE-2014-1972 (CVSS 7.8) — Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modifi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High