CVE-2022-46366: Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531…

PriorityP259critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.56%

88.0th percentile

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache	tapestry	>= 3.0.0 < 4.0.0	4.0.0

Detection & IOCsextracted from sources · hover to see the quote

·Vulnerability only affects Apache Tapestry 3.x (EOL/unsupported). The similar CVE-2020-17531 affects the also-unsupported 4.x line. No currently supported Tapestry version line is affected. ↗
·This CVE is distinct from CVE-2020-17531 despite being a similar deserialization RCE class of vulnerability; detection rules targeting CVE-2020-17531 (Tapestry 4.x) may not cover this issue. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ghsa9.8CRITICAL

osv9.8CRITICAL

vendor_redhat9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.