CVE-2025-64408: Apache Causeway: Java deserialization vulnerability to authenticated attackers
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.
This issue affects all current versions.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64408?
CVE-2025-64408 is rated as a critical vulnerability due to its potential for remote code execution.
How can I fix CVE-2025-64408?
To fix CVE-2025-64408, update to Apache Causeway version 3.5.0 or later, where the vulnerability has been addressed.
Who is affected by CVE-2025-64408?
CVE-2025-64408 affects all applications utilizing Apache Causeway's ViewModel functionality prior to version 3.5.0.
What type of attack is enabled by CVE-2025-64408?
CVE-2025-64408 enables authenticated attackers to perform remote code execution through controlled URL parameters.
Is authentication required to exploit CVE-2025-64408?
Yes, authentication is required for attackers to exploit CVE-2025-64408.