Vulnerability · Published Sep 30, 2020 · Assigned by apache
CVE-2020-13953
Medium 5.3
In plain English
A medium-severity security flaw in Apache Tapestry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)2.7%top 14.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.tapestry:tapestry-core | 5.6.0 | GHSA-w9mp-p2wp-2xf7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Tapestry | Apache Tapestry from 5.4.0 to 5.5.0 |
References
- https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E x_refsource_MISC
- [tapestry-users] 20210427 CVE-2021-30638: An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later mailing-list, x_refsource_MLIST