[CVE-2020-13953] Apache Tapestry WEB-INF file download vulnerability

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[CVE-2020-13953] Apache Tapestry WEB-INF file download vulnerability

Thiago H de Paula Figueiredo
CVE-2020-13953: Apache Tapestry: URL manipulation allows Java webapp files
inside WEB-INF to be listed and downloaded.

Vendor:
The Apache Software Foundation

Versions Affected:
Tapestry 5.4.0 to 5.5.0

Description:
Crafting specific URLs, an attacker can download files inside the WEB-INF
folder.

Mitigation:
Upgrade to Apache Tapestry 5.6.0 or later.

Credit:
This issue was discovered by Thomas Moore.

References:
https://tapestry.apache.org/security.html

--
Thiago