Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Tapestry
APPApache3.0.0 – 4.0.0 (bez)
Powiązane podatności
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestr...
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deseriali...
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing...
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and ...
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way i...