CVE-2025-64408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64408", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-11-03T17:08:27.439Z", "datePublished": "2025-11-19T10:32:05.808Z", "dateUpdated": "2026-11-03T22:03:07.444Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.causeway:*", "product": "Apache Causeway", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.4.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"status": "affected", "version": "4.0.0-M1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Slain Nico"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>\nApache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through&nbsp;user-controllable URL parameters. These vulnerabilities affect all&nbsp;applications using Causeway's ViewModel functionality and can be exploited&nbsp;by authenticated attackers to execute arbitrary code with application&nbsp;privileges.&nbsp;</p><p>This issue affects all current versions.</p><p>Users are recommended to upgrade to version 3.5.0, which fixes the issue.</p>"}], "value": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\u00a0user-controllable URL parameters. These vulnerabilities affect all\u00a0applications using Causeway's ViewModel functionality and can be exploited\u00a0by authenticated attackers to execute arbitrary code with application\u00a0privileges.\u00a0\n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "critical"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-11-19T10:32:05.808Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b"}], "source": {"defect": ["CAUSEWAY-3939"], "discovery": "EXTERNAL"}, "title": "Apache Causeway: Java deserialization vulnerability to authenticated attackers", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/11/19/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-19T12:08:21.438Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-64408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T04:55:23.008086Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:03:07.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/11/19/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-19T12:08:21.438Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-64408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T04:55:23.008086Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T16:19:16.130Z"}}], "cna": {"title": "Apache Causeway: Java deserialization vulnerability to authenticated attackers", "source": {"defect": ["CAUSEWAY-3939"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Slain Nico"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Causeway", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "3.4.0"}, {"status": "affected", "version": "4.0.0-M1", "versionType": "semver"}], "packageName": "org.apache.causeway:*", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\u00a0user-controllable URL parameters. These vulnerabilities affect all\u00a0applications using Causeway's ViewModel functionality and can be exploited\u00a0by authenticated attackers to execute arbitrary code with application\u00a0privileges.\u00a0\n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>\nApache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through&nbsp;user-controllable URL parameters. These vulnerabilities affect all&nbsp;applications using Causeway's ViewModel functionality and can be exploited&nbsp;by authenticated attackers to execute arbitrary code with application&nbsp;privileges.&nbsp;</p><p>This issue affects all current versions.</p><p>Users are recommended to upgrade to version 3.5.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-11-19T10:32:05.808Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64408", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:03:07.444Z", "dateReserved": "2025-11-03T17:08:27.439Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-11-19T10:32:05.808Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.causeway:*", "product": "Apache Causeway", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.4.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"status": "affected", "version": "4.0.0-M1", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:causeway:*:*:*:*:*:*:*:*", "matchCriteriaId": "B044B2DD-ECE0-4C1C-8EFA-74C875B864D4", "versionEndExcluding": "3.5.0", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:causeway:4.0.0:m1:*:*:*:*:*:*", "matchCriteriaId": "0DEE4E19-11F1-4BED-8766-8DD6EB5B68F8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\u00a0user-controllable URL parameters. These vulnerabilities affect all\u00a0applications using Causeway's ViewModel functionality and can be exploited\u00a0by authenticated attackers to execute arbitrary code with application\u00a0privileges.\u00a0\n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}, {"lang": "es", "value": "Apache Causeway se enfrenta a vulnerabilidades de deserializaci\u00f3n de Java que permiten la ejecuci\u00f3n remota de c\u00f3digo (RCE) a trav\u00e9s de par\u00e1metros de URL controlables por el usuario. Estas vulnerabilidades afectan a todas las aplicaciones que utilizan la funcionalidad ViewModel de Causeway y pueden ser explotadas por atacantes autenticados para ejecutar c\u00f3digo arbitrario con privilegios de aplicaci\u00f3n.\n\nEste problema afecta a todas las versiones actuales.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.5.0, que corrige el problema."}], "id": "CVE-2025-64408", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-20T04:55:23.008086Z", "version": "2.0.3"}}]}, "published": "2025-11-19T11:15:47.790", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/11/19/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"created": "2025-11-20T10:31:00.995581+00:00", "updated": "2025-11-20T10:31:00.995616+00:00", "vendors": ["apache", "apache$PRODUCT$causeway"]}