Description
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Tapestry | Apache Tapestry from 5.4.0 to 5.5.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tapestry:tapestry-core | >= 5.4.0, < 5.6.0 | 5.6.0 | GHSA-w9mp-p2wp-2xf7 |