CVE-2021-30638CWE-200

An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

published April 27, 2021

CVSS
—
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06559 · 93.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-04-27T18:30Z
EPSS history
Timeline
  • 27 APR 18:30Z
    An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later
    cvelistv5