CVE-2022-46366 — Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input

Description (CNA)

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Tapestry	affected Apache Tapestry before 4.0.0

CWE

CWE-502

References

https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj
http://www.openwall.com/lists/oss-security/2022/12/02/1
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj
http://www.openwall.com/lists/oss-security/2022/12/02/1
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md