PT-2021-18781 · Apache · Apache Tapestry

Kc Udonsi · Published 2021-04-27 · Updated 2022-10-27 · CVE-2021-30638

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions 5.4.0 through 5.6.3

Description The issue allows an attacker to download files inside WEB-INF using a specially-constructed URL, due to incomplete fix for a previous issue. This affects the context asset handling of Apache Tapestry.

Recommendations For Apache Tapestry versions 5.4.0 through 5.6.3, update to a version that includes a complete fix for the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2021-30638

GHSA-GHM8-MMX7-XVG2

ZDI-21-491

Affected Products

Apache Tapestry

References · 11

• https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-491 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-30638 · Security Note
• https://osv.dev/vulnerability/GHSA-ghm8-mmx7-xvg2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30638 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/04/27/3 · Note
• https://security.netapp.com/advisory/ntap-20210528-0004 · Note
• https://t.me/cvenotify/31129 · Telegram Post
• https://t.me/cvenotify/14197 · Telegram Post
• https://t.me/cvenotify/15177 · Telegram Post
• https://t.me/cvenotify/13913 · Telegram Post