Information Exposure in Apache Tapestry

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-30638 · ADVISORY
• lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E · WEB
• security.netapp.com/advisory/ntap-20210528-0004 · WEB
• zerodayinitiative.com/advisories/ZDI-21-491 · WEB
• openwall.com/lists/oss-security/2021/04/27/3 · WEB
• security.netapp.com/advisory/ntap-20210528-0004 · Third Party Advisory
• zerodayinitiative.com/advisories/ZDI-21-491 · Third Party Advisory

org.apache.tapestry:tapestry-core のその他の脆弱性

• CVE-2022-46366緊急 9.8Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from C…
• CVE-2022-31781高 7.5Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Speci…
• CVE-2021-27850緊急 9.8A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions inclu…
• CVE-2020-13953中 5.3In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being ru…
• CVE-2019-10071緊急 9.8The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparis…