Apache Tapestry
Approved changes feed: RSS · Atom
cpe:2.3:a:n/a:apache_tapestry:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | N/A (22f567d3-1203-528c-8f0e-3eb9c2f6ca78) |
|---|---|
| Product | Apache Tapestry (7d17da92-2195-5e71-a589-09857e468e59) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-13953 |
vulnerable | 2026-06-08 05:18:01.599493 |
Details available
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Published: 2020-09-30T16:51:59.000Z
Updated: 2024-08-04T12:32:14.261Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-0195 |
vulnerable | 2026-06-08 05:12:19.220730 |
Details available
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
Published: 2019-09-16T15:37:37.000Z
Updated: 2024-08-04T17:44:15.351Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.