Not rated
CVE-2020-17531 A Java Serialization vulnerability was found in Apache Tapestry 4
Description
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tapestry 4 | earliest → 4 | No fix stated |
References
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- [oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Tapestry
The 6 CVEs of Apache Tapestry →
CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets…
Not rated
CVE-2022-46366
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution
9.8
Critical
CVE-2022-31781
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it…
Not rated
CVE-2021-30638
Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files…
Not rated