CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

creationtimestamp| type| source ---|---|--- 2023-12-21 15:11:38+00:00| seen| https://t.me/ctinow/157737...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-tiles (>=3.0.0.release, <=3.1.0.release) +157 more potentially affected by CVE-2023-49735 via org.apache.tiles:tiles-core (>=2.0.1, <=3.0.8)

org.apache.tiles:tiles-core MAVEN version =2.0.1, =3.0.0.release, =3.0.0.release, =2.1.0, =1.2.2, =1.0.0, =1.0.1, =0.0.1, =1.0.14-vaadin1, =0.0.3, =0.0.3, =0.0.10 and more Source cves: CVE-2023-49735 Source advisory: OSV:GHSA-QW4H-3XJJ-84CC...

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

CVE-2023-49735

CVE-2023-49735 affects Apache Tiles (2 onward). The DefaultLocaleResolver.LOCALE_KEY value, when used to resolve XML definition files, is not validated, enabling path traversal and potentially SSRF/XXE when user-controlled data is supplied. This vulnerability is tied to Tiles usage and is noted a...