6.3

CVE-2025-64408

Apache Causeway: Java deserialization vulnerability to authenticated attackers

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Causeway Version >= 2.0.0 < 3.5.0
Apache ≫ Causeway Version 4.0.0 Update m1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.81% 0.955
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2025/11/19/1
Third Party Advisory
Mailing List