CVE-2020-17531
Critical
Description
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Tapestry
PublishedDec 8, 2020
First seenDec 8, 2020
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- apache tapestry5.0.1 or later
- org.apache.tapestry:tapestry-project5.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tapestry | 4.0.0 ≤ v < 5.0.1 | 5.0.1 |
| org.apache.tapestry:tapestry-projectMaven | 4.0 ≤ v < 5.0.1 | 5.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.