CVE-2021-30638 An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

2021-04-2718:30:15

CWE-200

apache

www.cve.org

6.5 Medium

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

CNA Affected

[
  {
    "product": "Apache Tapestry",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "Apache Tapestry 5.6.4",
        "status": "affected",
        "version": "Apache Tapestry ",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache Tapestry 5.7.2",
        "status": "affected",
        "version": "Apache Tapestry",
        "versionType": "custom"
      }
    ]
  }
]