CVE-2022-46366 - Vulnerability Details - OpenCVE

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.03788.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Tapestry

Configuration 1 [-]

cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-vc39-x7w6-6vj7	Apache Tapestry allows deserialization of untrusted data

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/12/02/1
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md
https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj
https://nvd.nist.gov/vuln/detail/CVE-2022-46366
https://www.cve.org/CVERecord?id=CVE-2022-46366

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-12-02T00:00:00

Updated: 2024-08-03T14:31:46.317Z

Reserved: 2022-12-02T00:00:00

Link: CVE-2022-46366

Vulnrichment

Updated: 2024-08-03T14:31:46.317Z

NVD

Status : Modified

Published: 2022-12-02T14:15:10.223

Modified: 2024-11-21T07:30:28.337

Link: CVE-2022-46366

Redhat

Severity : Moderate

Publid Date: 2022-12-02T00:00:00Z

Links: CVE-2022-46366 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-46366", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "dateUpdated": "2024-08-03T14:31:46.317Z", "dateReserved": "2022-12-02T00:00:00", "datePublished": "2022-12-02T00:00:00"}, "containers": {"cna": {"title": "Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-12-06T00:00:00"}, "descriptions": [{"lang": "en", "value": "Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry."}], "tags": ["unsupported-when-assigned"], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tapestry", "versions": [{"version": "Apache Tapestry", "status": "affected", "lessThan": "4.0.0", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj"}, {"name": "[oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/12/02/1"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md"}], "credits": [{"lang": "en", "value": "Apache would like to thank Ilyass El Hadi from Mandiant for reporting this issue"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-46366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:18:53.714851Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:tapestry:-:*:*:*:*:*:*:*"], "vendor": "apache", "product": "tapestry", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:16:08.208Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:31:46.317Z"}, "title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj", "tags": ["x_transferred"]}, {"name": "[oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/12/02/1"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/12/02/1", "name": "[oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:31:46.317Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-46366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:18:53.714851Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:tapestry:-:*:*:*:*:*:*:*"], "vendor": "apache", "product": "tapestry", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T14:19:02.191Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "value": "Apache would like to thank Ilyass El Hadi from Mandiant for reporting this issue"}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tapestry", "versions": [{"status": "affected", "version": "Apache Tapestry", "lessThan": "4.0.0", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj"}, {"url": "http://www.openwall.com/lists/oss-security/2022/12/02/1", "name": "[oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "tags": ["mailing-list"]}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-12-06T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2022-46366", "state": "PUBLISHED", "dateUpdated": "2024-08-03T14:31:46.317Z", "dateReserved": "2022-12-02T00:00:00", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2022-12-02T00:00:00", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4364FAE-8835-4660-9187-EBF8DF48FCC7", "versionEndExcluding": "4.0.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "security@apache.org", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry."}, {"lang": "es", "value": "Apache Tapestry 3.x permite la deserializaci\u00f3n de datos que no son de confianza, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. Este problema es similar pero distinto de CVE-2020-17531, que aplica la l\u00ednea de versi\u00f3n 4.x (tampoco compatible). NOTA: Esta vulnerabilidad solo afecta a la versi\u00f3n 3.x de Apache Tapestry, que ya no es compatible con el fabricante. Se recomienda a los usuarios actualizar a una l\u00ednea de versi\u00f3n compatible de Apache Tapestry."}], "id": "CVE-2022-46366", "lastModified": "2024-11-21T07:30:28.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-02T14:15:10.223", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/12/02/1"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md"}, {"source": "security@apache.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/12/02/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "Tapestry: prior to version 4 (EOL) allows RCE though deserialization of untrusted input", "id": "2150937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150937"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-502", "details": ["Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry."], "name": "CVE-2022-46366", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:6", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Migration Toolkit for Applications 6"}, {"cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Migration Toolkit for Runtimes"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat Decision Manager 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "Tapestry", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2022-12-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-46366\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-46366"], "threat_severity": "Moderate"}