Tag :
1. Summary
| Vulnerability Name | Apache Tapestry Deserialization Vulnerability |
|---|---|
| Attack Type | Deserialization |
| Time Discovered | 2022-12-05 |
| Updated Time | 2022-12-08 |
| CVE ID | CVE-2022-46366 |
The vulnerability is due to the full version of Apache Tapestry 3 allowing the deserialization of untrusted data, which results in remote code execution.
2. Affected Versions
3.0≤ Apache Tapestry < 4.0
3. Solution
- Sangfor Cyber Guardian - Sangfor experts offer 24/7 security operations service. Sangfor experts conduct vulnerability scan across the network in the first place when vulnerability exploit occurs. Even if vulnerability exists in any host, check and update security policies on your Sangfor security device have been made to prevent possible vulnerability exploits.
- Sangfor NGAF - Updates to the latest security protection policies can make protection against this high-severity vulnerability very easy.
- Sangfor Cyber Command - Realtime alerts can be triggered when vulnerability exploit is detected, meanwhile, correlation to Sangfor NGAF will be made to block attacker IP address.
- Currently, the latest version has been officially released, and affected users are advised to update and upgrade to the latest version in time. The link is as follows: https://tapestry.apache.org/download.html
