| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tapestry:tapestry-core | ≥ 5.4.0, < 5.6.0 | 5.6.0 |
| tapestry | ≥ 5.4.0, < 5.6.4≥ 5.7.0, < 5.7.2 | 5.6.45.7.2 |
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free