| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tapestry:tapestry-core | ≥ 5.4.0, < 5.6.4≥ 5.7.0, < 5.7.2 | 5.6.45.7.2 |
| tapestry | ≥ 5.4.0, < 5.6.4≥ 5.7.0, < 5.7.2 | 5.6.45.7.2 |
Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free