CVE-2023-49735 Apache Tiles: Unvalidated input may lead to path traversal and XXE

2023-11-3021:17:28

CWE-22

apache

www.cve.org

apache tiles

unvalidated input

path traversal

ssrf/xxe

defaultlocaleresolver

xml definition files

0.001 Low

EPSS

Percentile

23.1%

JSON

UNSUPPORTED WHEN ASSIGNED

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the ‘tiles-test’ application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tiles",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "*",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p

0.001 Low

EPSS

Percentile

23.1%

JSON

Related for CVELIST:CVE-2023-49735