~ / search / GHSA-w9mp-p2wp-2xf7

GHSA-w9mp-p2wp-2xf7

Improper file downloads in Apache Tapestry

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-13953

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tapestry:tapestry-core >= 5.4.0, < 5.6.0 5.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.

References

External links from the advisory. They lead to third-party sites.