CVE-2025-64408

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/19/1	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:causeway::::::::
	cpe:2.3:a:apache:causeway:4.0.0:m1::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Apache Causeway se enfrenta a vulnerabilidades de deserialización de Java que permiten la ejecución remota de código (RCE) a través de parámetros de URL controlables por el usuario. Estas vulnerabilidades afectan a todas las aplicaciones que utilizan la funcionalidad ViewModel de Causeway y pueden ser explotadas por atacantes autenticados para ejecutar código arbitrario con privilegios de aplicación. Este problema afecta a todas las versiones actuales. Se recomienda a los usuarios actualizar a la versión 3.5.0, que corrige el problema.

Information

Published : 2025-11-19 11:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64408

Mitre link : CVE-2025-64408

CVE.ORG link : CVE-2025-64408

JSON object : View

Products Affected

apache

causeway

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-64408", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64408", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T04:55:23.008086Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Causeway", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "3.4.0"}, {"status": "affected", "version": "4.0.0-M1", "versionType": "semver"}], "packageName": "org.apache.causeway:*", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2025-11-19T11:15:47.790", "references": [{"url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/19/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\u00a0user-controllable URL parameters. These vulnerabilities affect all\u00a0applications using Causeway's ViewModel functionality and can be exploited\u00a0by authenticated attackers to execute arbitrary code with application\u00a0privileges.\u00a0\n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}, {"lang": "es", "value": "Apache Causeway se enfrenta a vulnerabilidades de deserializaci\u00f3n de Java que permiten la ejecuci\u00f3n remota de c\u00f3digo (RCE) a trav\u00e9s de par\u00e1metros de URL controlables por el usuario. Estas vulnerabilidades afectan a todas las aplicaciones que utilizan la funcionalidad ViewModel de Causeway y pueden ser explotadas por atacantes autenticados para ejecutar c\u00f3digo arbitrario con privilegios de aplicaci\u00f3n.\n\nEste problema afecta a todas las versiones actuales.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.5.0, que corrige el problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:causeway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B044B2DD-ECE0-4C1C-8EFA-74C875B864D4", "versionEndExcluding": "3.5.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:causeway:4.0.0:m1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DEE4E19-11F1-4BED-8766-8DD6EB5B68F8"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}