PT-2020-13801 · Apache · Apache Tapestry

Published 2020-09-30 · Updated 2022-06-05 · CVE-2020-13953

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions 5.4.0 through 5.5.0

Description The issue allows an attacker to download files inside the WEB-INF folder of the WAR being run by crafting specific URLs.

Recommendations For Apache Tapestry versions 5.4.0 through 5.5.0, consider restricting access to sensitive files within the WEB-INF folder until a patch is available. As a temporary workaround, review and limit the handling of user-inputted URLs to minimize the risk of exploitation.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2020-13953

GHSA-W9MP-P2WP-2XF7

Affected Products

Apache Tapestry

References · 11

• https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13953 · Security Note
• https://osv.dev/vulnerability/GHSA-w9mp-p2wp-2xf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13953 · Vendor Advisory
• https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E · Note
• https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb@%3Cusers.tapestry.apache.org%3E · Note
• https://t.me/cvenotify/13913 · Telegram Post
• https://t.me/cvenotify/31129 · Telegram Post
• https://t.me/cvenotify/14075 · Telegram Post
• https://t.me/cvenotify/15177 · Telegram Post
• https://t.me/cvenotify/14197 · Telegram Post