CVE-2022-31781

CVE-2022-31781 affects Apache Tapestry up to version 5.8.1. It is a Regular Expression Denial of Service (ReDoS) vulnerability in how the ContentType class handles Content Types, where crafted inputs may cause catastrophic backtracking and exponential-time processing. The issue is triggered only ...

CVE-2022-31781 Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on...

CVE-2022-31781 Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on...

PT-2022-20927 · Apache · Apache Tapestry

Name of the Vulnerable Software and Affected Versions: Apache Tapestry versions up to 5.8.1 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the way Apache Tapestry handles Content Types. Specially crafted Content Types can cause catastrophic backtracking, taki...

Apache Tapestry 安全漏洞

Apache Tapestry is a web application framework written in the Java language from the Apache Foundation, U.S. A denial-of-service vulnerability exists in versions of Apache Tapestry prior to 5.8.1, which stems from a vulnerability in the way content types are handled to improper regular expression...

com.nhl.bootique.tapestry:bootique-tapestry (=0.1), de.julielab:julie-elastic-query-components (=1.0.3) +27 more potentially affected by CVE-2019-0195 via org.apache.tapestry:tapestry-core (>=5.4.0 <=5.4.4)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =0.2, =1.2.0, =1.1.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.4 and more Source cves: CVE-2019-0195 Source advisory: OSV:GHSA-6MWH-FW4P-75FJ...

GHSA-6MWH-FW4P-75FJ Deserialization of Untrusted Data in Apache Tapestry

By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this...

Deserialization of Untrusted Data in Apache Tapestry

By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this...

br.com.arsmachina:tapestry-url-rewriter (>=1.0.1 <=2.0.0), com.adaptrex:adaptrex-core (>=0.9.11 <=1.0-Alpha3) +74 more potentially affected by CVE-2014-1972 via org.apache.tapestry:tapestry-core (>=5.0.10 <=5.3.5)

org.apache.tapestry:tapestry-core MAVEN version =5.0.10, =1.0.1, =0.9.11, =1.0.4, =0.1.1, =0.8.6, =0.8.6, =0.9, =0.8.9, =0.8.9, =0.3, =3.0.2, =0.9, =3.0.1, =3.2.1 - com.jexbox.connector:jexbox-tapestry =0.0.1 - com.joshcanfield:tapestry-monitoring =1.0.1 and more Source cves: CVE-2014-1972 Source...

GHSA-C438-8CVQ-PXXX Apache Tapestry Unsafe Object Storage

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

Apache Tapestry Unsafe Object Storage

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

be.dnsbelgium:rdap-server (>=0.3.3 <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0 <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.RELEASE <=3.1.4.RELEASE)

org.springframework.security:spring-security-core MAVEN version =3.1.0.RELEASE, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core =1.0.0 - com.github.yongjacky:jee.borneo.miri =1.1.6 -...

at.porscheinformatik.tapestry:tapestry-csrf-protection (=3.0.0.RELEASE), net.wicp.tams:tams-component (=1.2.7) +10 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.7.0 <=5.7.1)

org.apache.tapestry:tapestry-core MAVEN version =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 Source cves: CVE-2021-30638 Source advisory: OSV:GHSA-GHM8-MMX7-XVG2...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.RELEASE <=2.0.1.RELEASE), com.flowlogix:flowlogix-tapestry (>=3.0 <=4.0.2) +36 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.4.0 <=5.6.3)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =2.0.0.RELEASE, =3.0, =3.0, =3.0, =1.2.0, =0.2, =1.1, =1.2.0, =1.1.0, =5.4.0, =5.6.3 and more Source cves: CVE-2021-30638 Source advisory: OSV:GHSA-GHM8-MMX7-XVG2...

GHSA-GHM8-MMX7-XVG2 Information Exposure in Apache Tapestry

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to...

Information Exposure in Apache Tapestry

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to...

com.adaptrex:adaptrex-core (>=0.9.13 <=1.0-Alpha3), com.adaptrex:adaptrex-sandbox-core (>=0.9.13 <=1.0-Alpha3) +82 more potentially affected by CVE-2022-24289 via org.apache.cayenne:cayenne-server (>=3.0M4 <=4.1.RC2)

org.apache.cayenne:cayenne-server MAVEN version =3.0M4, =0.9.13, =0.9.13, =0.9.13, =0.9.13, =0.12, =0.8, =0.6, =1.6, =1.7, =1.7, =1.14, =1.23, =2.11, =2.10, =0.6.0.2, =0.7.3 and more Source cves: CVE-2022-24289 Source advisory: OSV:GHSA-C58C-W527-H77P...

com.nhl.bootique.tapestry:bootique-tapestry (=0.1), de.julielab:julie-elastic-query-components (=1.0.3) +31 more potentially affected by CVE-2020-13953 via org.apache.tapestry:tapestry-core (>=5.4.0 <=5.5.0)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =1.2.0, =0.2, =1.1, =1.2.0, =1.1.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.5.0-beta-3 and more Source cves: CVE-2020-13953 Source advisory: OSV:GHSA-W9MP-P2WP-2XF7...

GHSA-W9MP-P2WP-2XF7 Improper file downloads in Apache Tapestry

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

Improper file downloads in Apache Tapestry

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...