CVE-2022-24289

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.

• CWE-502
• CWE-502

• http://www.openwall.com/lists/oss-security/2022/02/11/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vcVendor Advisory
• http://www.openwall.com/lists/oss-security/2022/02/11/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vcVendor Advisory

Published

Feb 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24281A vulnerability has been identified in SINEC NMS (All versio…7.2
• CVE-2022-24282A vulnerability has been identified in SINEC NMS (All versio…7.2
• CVE-2022-24285Acer Care Center 4.00.30xx before 4.00.3042 contains a local…7.8
• CVE-2022-24286Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx be…7.8
• CVE-2022-24287A vulnerability has been identified in SIMATIC PCS 7 V8.2 (A…7.8
• CVE-2022-24288In Apache Airflow, prior to version 2.2.4, some example DAGs…8.8
• CVE-2022-2429The Ultimate SMS Notifications for WooCommerce plugin for Wo…8
• CVE-2022-24290A vulnerability has been identified in Teamcenter V12.4 (All…7.5
• CVE-2022-24291Certain HP Print devices may be vulnerable to potential info…7.5
• CVE-2022-24292Certain HP Print devices may be vulnerable to potential info…9.8
• CVE-2022-24293Certain HP Print devices may be vulnerable to potential info…9.8
• CVE-2022-24294A regular expression used in Apache MXNet (incubating) is vu…7.5