{
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
      },
      "title": "Java deserialization vulnerability to authenticated attackers",
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "cweId": "CWE-502",
              "type": "CWE"
            }
          ]
        }
      ],
      "source": {
        "defect": [
          "CAUSEWAY-3939"
        ],
        "discovery": "EXTERNAL"
      },
      "affected": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Causeway",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.causeway:*",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThanOrEqual": "3.4.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0-M1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ],
      "descriptions": [
        {
          "value": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\u00a0user-controllable URL parameters. These vulnerabilities affect all\u00a0applications using Causeway's ViewModel functionality and can be exploited\u00a0by authenticated attackers to execute arbitrary code with application\u00a0privileges.\u00a0\n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>\nApache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through&nbsp;user-controllable URL parameters. These vulnerabilities affect all&nbsp;applications using Causeway's ViewModel functionality and can be exploited&nbsp;by authenticated attackers to execute arbitrary code with application&nbsp;privileges.&nbsp;</p><p>This issue affects all current versions.</p><p>Users are recommended to upgrade to version 3.5.0, which fixes the issue.</p>"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b",
          "tags": [
            "vendor-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "type": "Textual description of severity",
            "content": {
              "text": "critical"
            }
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Slain Nico",
          "type": "reporter"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "cveId": "CVE-2025-64408",
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "serial": 1,
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}