Apache Tapestry
Monthly
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.