Apache Tapestry allows deserialization of untrusted data

緊急 9.8CVE-2022-46366 · GHSA-vc39-x7w6-6vj7 · 02/12/2022 公開 · 17/06/2026 更新

要点

CVE-2022-46366 は org.apache.tapestry:tapestry-core, tapestry (apache) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.5%（全脆弱性の 89.2% より高い）。
対処：5.0.1, 4.0.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.tapestry:tapestry-core Maven	`≥ 3.0, < 5.0.1`	`5.0.1`
tapestry apache	`≥ 3.0.0, < 4.0.0`	`4.0.0`

概要

** UNSUPPORTED WHEN ASSIGNED ** Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line.

NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

NVD の説明

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.