GitHub Advisoryadvisory · Maven

GHSA-89r3-rcpj-h7w6 Path traversal attack on Windows platforms

HIGH Published 2019-11-18 Modified 2023-03-06 Official page ↗
Aliases
CVE-2019-0207
Ecosystem
Maven
Packages
org.apache.tapestry:tapestry-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2019-11-18

Affected packages

• Maven org.apache.tapestry:tapestry-core: >= 5.4.0, < 5.4.5 → fixed in 5.4.5

Description

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Related

Alias · CVE (1)

  • CVE-2019-0207 Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References