Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2020-17531 EUVD-2022-0951GHSA-c566-2grg-mjwg

Deserialization flaw in EOL Tapestry 4.

Published Dec 8, 2020 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tapestry Package: org.apache.tapestry:tapestry-project Ecosystem: Maven

Description

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tapestry Apache Tapestry 4 – ≤ 4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 154802388/CVE-2020-17531 ★ 0 · Dec 9, 2020

    Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞（CVE-2020-17530），在使用某些tag等情况下可能存在OGNL表达式注入漏洞，从而造成远程代码执行，风险极大。提醒我校Apache Struts用户尽快采取安全措施阻止漏洞攻击。

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tapestry:tapestry-project >= 4.0, < 5.0.1 5.0.1 GHSA-c566-2grg-mjwg

References