Improper file downloads in Apache Tapestry

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-13953 · ADVISORY
• lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb@%3Cusers.tapestry.apache.org%3E · WEB
• lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E · WEB
• lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E

org.apache.tapestry:tapestry-core のその他の脆弱性

• CVE-2022-46366緊急 9.8Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from C…
• CVE-2022-31781高 7.5Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Speci…
• CVE-2021-30638高 7.5Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using…
• CVE-2021-27850緊急 9.8A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions inclu…
• CVE-2019-10071緊急 9.8The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparis…