GHSA-wq4c-57mh-5f7g

Suggest an improvement
Source
https://github.com/advisories/GHSA-wq4c-57mh-5f7g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wq4c-57mh-5f7g
Aliases
Published
2025-11-19T12:30:21Z
Modified
2025-11-20T14:43:59Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Apache Causeway vulnerable to deserialization in Java
Details

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-11-19T20:33:30Z",
    "nvd_published_at":  "2025-11-19T11:15:47Z",
    "severity":  "CRITICAL"
}
References

Affected packages

Maven
org.apache.causeway.commons:causeway-commons

Package

Name
org.apache.causeway.commons:causeway-commons
View open source insights on deps.dev
Purl
pkg:maven/org.apache.causeway.commons/causeway-commons

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.0

Affected versions

2.*
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0-RC4
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json"
org.apache.causeway.core:causeway-applib

Package

Name
org.apache.causeway.core:causeway-applib
View open source insights on deps.dev
Purl
pkg:maven/org.apache.causeway.core/causeway-applib

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.0

Affected versions

2.*
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0-RC4
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json"
org.apache.causeway.core:causeway-core

Package

Name
org.apache.causeway.core:causeway-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.causeway.core/causeway-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.0

Affected versions

2.*
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0-RC4
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json"
org.apache.causeway.viewer:causeway-viewer-wicket

Package

Name
org.apache.causeway.viewer:causeway-viewer-wicket
View open source insights on deps.dev
Purl
pkg:maven/org.apache.causeway.viewer/causeway-viewer-wicket

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.0

Affected versions

2.*
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0-RC4
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json"