CVE-2021-27850

🗓️ 15 Apr 2021 07:40:11Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 246 Views🌐 WEB

Critical unauthenticated remote code execution vulnerability in Apache Tapestry versions 5.4.5, 5.5.0, 5.6.2, and 5.7.0 allows bypass of CVE-2019-0195 fix, leading to potential RCE

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Tapestry	25 Jun 202113:55	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Tapestry	26 Jun 202114:16	–	githubexploit
ATTACKERKB	CVE-2021-27850	15 Apr 202108:15	–	attackerkb
Circl	CVE-2021-27850	26 Jun 202113:47	–	circl
CNNVD	Apache Tapestry 代码问题漏洞	15 Apr 202100:00	–	cnnvd
CNVD	Apache Tapestry Code Execution Vulnerability	16 Apr 202100:00	–	cnvd
Cvelist	CVE-2021-27850 Bypass of the fix for CVE-2019-0195	15 Apr 202107:40	–	cvelist
Github Security Blog	Remote code execution in Apache Tapestry	16 Jun 202117:33	–	github
Metasploit	Apache Tapestry HMAC secret key leak	23 Jul 202117:45	–	metasploit
Nuclei	Apache Tapestry - Remote Code Execution	23 Jul 202603:49	–	nuclei

NVD

Vulners

Node

apache tapestryRange5.4.0–5.6.2

apache tapestryRange5.7.0–5.7.1

[
  {
    "product": "Apache Tapestry",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Tapestry 5.5.0"
      },
      {
        "status": "affected",
        "version": "Apache Tapestry 5.7.0"
      },
      {
        "lessThan": "Apache Tapestry 5.4.0*",
        "status": "affected",
        "version": "Apache Tapestry 5.4.5",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache Tapestry 5.6.0*",
        "status": "affected",
        "version": "Apache Tapestry 5.6.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/04/15/1
security	www.security.netapp.com/advisory/ntap-20210528-0002/
lists	www.lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E

Parameter	Position	Path	Description	CWE
AppModule.class	path	assets/something/services/AppModule.class	By downloading the AppModule.class file from the server, attacker can leak the HMAC signing key used for serialized objects, enabling RCE payloads.	CWE-502, CWE-200
AppModule.class	path	assets/something/services/AppModule.class/	By appending a trailing slash to the class file URL, bypassing blacklist and retrieving AppModule.class to obtain the HMAC key for crafting remote code execution payloads.	CWE-502, CWE-200

17 Jun 2026 03:45Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

EPSS0.93802

apache tapestry remote code execution unauthenticated cve-2021-27850 security vulnerability bypass patch upgrade nvd