Apache Tapestry

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:apache_tapestry:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductApache Tapestry (b5348da4-cf1c-5e85-a8b3-dd87fb1d57cc)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-10071 vulnerable 2026-06-08 05:12:22.099530 Details available
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Published: 2019-09-16T17:46:19.000Z
Updated: 2024-08-04T22:10:09.295Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-0207 vulnerable 2026-06-08 05:12:19.295765 Details available
Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
Published: 2019-09-16T16:36:14.000Z
Updated: 2024-08-04T17:44:15.383Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.