Skip to content
OpenAdvisories

Product · Apache

Apache Tapestry

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2019-0207 Public exploit

    Path traversal attack on Windows platforms

    Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

    Apache Apache Tapestry org.apache.tapestry:tapestry-core Maven