CVE-2022-46366 — Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the …
Published: 2022-12-02 · CVSS: 9.8 · CVSS 3.1
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7