Skip to content
OpenAdvisories

Package · Maven

org.apache.tapestry:tapestry-core

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical —
    CVE-2021-27850 Public exploit Scanner template EPSS 94%

    Bypass of the fix for CVE-2019-0195

    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Befor…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven
  • High 7.5
    CVE-2019-0207 Public exploit

    Path traversal attack on Windows platforms

    Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

    Apache Apache Tapestry org.apache.tapestry:tapestry-core Maven