CVE-2023-49735CWE-22

Apache Tiles: Unvalidated input may lead to path traversal and XXE

published November 30, 2023

CVSS
—
EPSS
1%
Percentile
71.2
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED **

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01345 · 71.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-11-30T21:17Z
EPSS history
Timeline
  • 30 NOV 21:17Z
    Apache Tiles: Unvalidated input may lead to path traversal and XXE
    cvelistv5