CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.

2020-12-0800:00:00

CWE-502

apache

www.cve.org

9.4 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.4%

JSON

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the “sp” parameter even before invoking the page’s validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Tapestry",
    "versions": [
      {
        "version": "Apache Tapestry 4",
        "status": "affected",
        "lessThanOrEqual": "4",
        "versionType": "custom"
      }
    ]
  }
]