PUBLISHED
2025-11-19 11:15
MODIFIED
2025-11-19 11:15
EPSS (Prob. Exploit)
11.56%
Top 4.0%
> DESCRIPTION
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.
This issue affects all current versions.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-wq4c-57mh-5f7g
CRITICAL
Apache Causeway vulnerable to deserialization in Java
AFFECTED PACKAGES:
MAVEN / org.apache.causeway.viewer:causeway-viewer-wicket
< 3.5.0
Fixed in: 3.5.0
MAVEN / org.apache.causeway.core:causeway-core
< 3.5.0
Fixed in: 3.5.0
MAVEN / org.apache.causeway.core:causeway-applib
< 3.5.0
Fixed in: 3.5.0
MAVEN / org.apache.causeway.commons:causeway-commons
< 3.5.0
Fixed in: 3.5.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
AFFECTED PACKAGES:
Unknown / Unknown
106 versions affected
ALIASES:
GHSA-wq4c-57mh-5f7g
> HISTORIQUE DES MODIFICATIONS
Première apparition
19/11/2025 11:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/12/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 2
Dernière mise à jour: 9 months ago