Skip to content
Sign in
Not rated

CVE-2019-0207 Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`,…

Description

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Affected products and versions

Product Affected versions Fixed in
Apache Tapestry Versions not published

Other CVEs of Apache Tapestry

The 2 CVEs of Apache Tapestry →
CVE-2019-10071 The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side… Not rated
Track this CVE