Vulnerability · Published Feb 11, 2022 · Assigned by apache

CVE-2022-24289Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions

High 8.8

In plain English

A high-severity unsafe deserialization in Apache Cayenne from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)2.3%top 16.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.cayenne:cayenne-server	4.1.1	GHSA-c58c-w527-h77p

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Cayenne	4.1 – through 4.1

Weakness: CWE-502

References

https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vc x_refsource_MISC
[oss-security] 20220211 CVE-2022-24289: Apache Cayenne: Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions mailing-list, x_refsource_MLIST