CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
UNSUPPORTED WHEN ASSIGNED Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-46366?
CVE-2022-46366 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2022-46366?
To mitigate CVE-2022-46366, upgrade to a version of Apache Tapestry that is not affected, as the 3.x and 4.x versions are no longer supported.
What are the risk consequences of CVE-2022-46366?
The risk consequences of CVE-2022-46366 include unauthorized remote access and control over the affected system.
Which versions of Apache Tapestry are affected by CVE-2022-46366?
CVE-2022-46366 affects all versions of Apache Tapestry from 3.0.0 up to but not including 4.0.0.
Is there a workaround for CVE-2022-46366?
There is no official workaround for CVE-2022-46366; the only solution is to upgrade to a supported version.