Non notée
CVE-2020-17531 A Java Serialization vulnerability was found in Apache Tapestry 4
Description
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Tapestry 4 | premières → 4 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- [oss-security] 20221202 CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Tapestry
Les 6 CVE de Apache Tapestry →
CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets…
Non notée
CVE-2022-46366
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution
9.8
Critique
CVE-2022-31781
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it…
Non notée
CVE-2021-30638
Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files…
Non notée