CVE-2020-17531: falha em Apache Tapestry
Deserialization flaw in EOL Tapestry 4.
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 10.0%
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Produtos afetados
Apache Software Foundation · Apache TapestryCVEs relacionadas — Apache Tapestry
No mesmo produto, das mais perigosas para as menos.
CVE-2021-27850—Bypass of the fix for CVE-2019-0195EPSS 93.6%CVE-2021-30638—An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterEPSS 6.6%CVE-2022-46366CRITICALApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputEPSS 3.5%CVE-2022-31781—Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)EPSS 2.0%CVE-2026-61899HIGHApache Tapestry: Possible classpath file download through URL manipulationEPSS 0.7%