GitHub Advisoryadvisory · Maven

GHSA-c438-8cvq-pxxx Apache Tapestry Unsafe Object Storage

HIGH Published 2022-05-13 Modified 2023-08-07 Official page ↗
Aliases
CVE-2014-1972
Ecosystem
Maven
Packages
org.apache.tapestry:tapestry-core
Severity
High
Weaknesses
CWE-502
Reviewed
2023-08-07

Affected packages

• Maven org.apache.tapestry:tapestry-core: < 5.3.6 → fixed in 5.3.6

Description

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

Related

Alias · CVE (1)

  • CVE-2014-1972 Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References