Remote code execution in Apache Tapestry

🗓️ 16 Jun 2021 17:33:19Reported by GitHub Advisory DatabaseType

Critical remote code execution vulnerability in Apache Tapestry versions 5.4.5, 5.5.0, 5.6.2, and 5.7.0, allowing unauthenticated attackers to bypass the fix for CVE-2019-0195 and execute arbitrary code

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Tapestry	25 Jun 202113:55	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Tapestry	26 Jun 202114:16	–	githubexploit
ATTACKERKB	CVE-2021-27850	15 Apr 202100:00	–	attackerkb
Circl	CVE-2021-27850	26 Jun 202113:47	–	circl
CNNVD	Apache Tapestry 代码问题漏洞	15 Apr 202100:00	–	cnnvd
CNVD	Apache Tapestry Code Execution Vulnerability	16 Apr 202100:00	–	cnvd
CVE	CVE-2021-27850	15 Apr 202107:40	–	cve
Cvelist	CVE-2021-27850 Bypass of the fix for CVE-2019-0195	15 Apr 202107:40	–	cvelist
Metasploit	Apache Tapestry HMAC secret key leak	23 Jul 202117:45	–	metasploit
Nuclei	Apache Tapestry - Remote Code Execution	23 Apr 202607:16	–	nuclei

Vulners

Node

org.apache.tapestry tapestry-coreRange5.7.0–5.7.1maven

org.apache.tapestry tapestry-coreRange5.4.0–5.6.3maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-27850
issues	www.issues.apache.org/jira/browse/TAP5-2663
lists	www.lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E
openwall	www.openwall.com/lists/oss-security/2021/04/15/1
security	www.security.netapp.com/advisory/ntap-20210528-0002/
github	www.github.com/advisories/GHSA-mj8x-cpr8-x39h

01 Feb 2023 05:05Current

0.8Low risk

Vulners AI Score0.8

CVSS 3.19.8

CVSS 210

EPSS0.94219