CVE-2019-0207

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`…

published September 16, 2019

CVSS
—
EPSS
3%
Percentile
87.6
In the wild
Unconfirmed
What it is

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03094 · 87.6th percentile
Published
2019-09-16T16:36Z
EPSS history
Timeline
  • 16 SEP 16:36Z
    Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`…
    cvelistv5