PT-2023-31314 · Apache+1 · Apache Tiles+1
Joseph Beeton
·
Published
2023-11-30
·
Updated
2024-08-02
·
CVE-2023-49735
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tiles versions 2 onwards
Description
The issue arises from the lack of validation of the value set as the
DefaultLocaleResolver.LOCALE KEY attribute on the session while resolving XML definition files. This can lead to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. The use of user-controlled data in this key may be relatively common, as seen in the 'tiles-test' application shipped with Tiles, where it was used to set the language.Recommendations
As a temporary workaround, consider disabling the use of the
DefaultLocaleResolver.LOCALE KEY attribute until a patch is available. Restrict access to the XML definition files to minimize the risk of exploitation. Avoid using user-controlled data in the DefaultLocaleResolver.LOCALE KEY attribute until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.XML Entity Expansion
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Tiles
Debian