Skip to main content

Tapestry CVE-2020-13953

MEDIUM
Files or Directories Accessible to External Parties (CWE-552)
2020-09-30 security@apache.org
Apache Path Traversal Information Disclosure Tapestry
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 30, 2020 - 18:15 nvd
MEDIUM 5.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 20 maven packages depend on org.apache.tapestry:tapestry-core (19 direct, 1 indirect)

Ecosystem-wide dependent count for version 5.4.0.

DescriptionNVD

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.

AnalysisAI

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-552. In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run. Affected products include: Apache Tapestry.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Tapestry

View all
CVE-2021-27850 CRITICAL POC
9.8 Apr 15

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. Rated c
CVE-2022-46366 CRITICAL
9.8 Dec 02

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. Rated critical severity

CVE-2020-17531 CRITICAL
9.8 Dec 08

A Java Serialization vulnerability was found in Apache Tapestry 4. Rated critical severity (CVSS 9.8), this vulnerabilit
CVE-2019-10071 CRITICAL
9.8 Sep 16

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side chan
CVE-2019-0195 CRITICAL
9.8 Sep 16

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it do
CVE-2014-1972 HIGH
7.8 Aug 22

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an obje
CVE-2022-31781 HIGH
7.5 Jul 13

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles

CVE-2021-30638 HIGH
7.5 Apr 27

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files ins
CVE-2019-0207 HIGH
7.5 Sep 16

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, w

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all
CVE-2016-3715 MEDIUM POC
5.5
CVE-2017-16651 HIGH POC
7.8
CVE-2023-6266 HIGH POC
7.5
CVE-2021-22015 HIGH POC
7.8
CVE-2017-14942 CRITICAL POC
9.8
CVE-2015-5211 CRITICAL POC
9.6
CVE-2020-37082 CRITICAL POC
9.8
CVE-2024-53676 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2020-13953 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy