CVE-2019-0207

published 2019-09-16

CVE-2019-0207: Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	apache_tapestry	—	—
apache	tapestry	5.4.0 – 5.4.4	—

CWE-22