Description
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tapestry | 5.5.0 – < 5.9.1 | 5.9.1 |
References
- https://lists.apache.org/thread/6j3yojqrdsxkrfz52d0zjyrf5n9xttmw vendor-advisory