Apache Tiles: Unvalidated input may lead to path traversal and XXE

高 7.5CVE-2023-49735 · GHSA-qw4h-3xjj-84cc · 30/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-49735 は org.apache.struts:struts-tiles, org.apache.tiles:tiles-core, struts:struts に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 71.6% より高い）。
修正版の情報はまだありません。参考情報のベンダー勧告を確認してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.struts:struts-tiles Maven	`≥ 1.3.0, ≤ 1.3.10`	修正版なし
org.apache.tiles:tiles-core Maven	`≥ 2.0.0`	修正版なし
struts:struts Maven	`≥ 1.1, ≤ 1.2.9`	修正版なし
tiles apache	`≥ 2.0`	修正版なし

概要

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD の説明

** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.