GitHub Advisoryadvisory · Maven

GHSA-qw4h-3xjj-84cc Apache Tiles: Unvalidated input may lead to path traversal and XXE

HIGH Published 2023-12-01 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-49735
Ecosystem
Maven
Packages
org.apache.tiles:tiles-core, org.apache.struts:struts-tiles, struts:struts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-776
Reviewed
2023-12-11

Affected packages

• Maven org.apache.tiles:tiles-core: >= 2.0.0 (no fix yet) • Maven org.apache.struts:struts-tiles: >= 1.3.0, <= 1.3.10 (no fix yet) • Maven struts:struts: >= 1.1, <= 1.2.9 (no fix yet)

Description

The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2023-49735 ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References