CVE Feed

    Dashboard / CVE / CVE-2019-10071

    CVE-2019-10071

    The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.

    Published:Sep 16, 2019
    Last Modified:Nov 21, 2024
    EPS:Sep 16, 2019
    EPSS Score:0.09816
    CVSS Score:9.8

    Affected Products

    Vendor
    Apache
    Product
    Tapestry

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-203 Observable Discrepancy

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-189 Black Box Reverse Engineering

    Related CVEs

    CVE-2026-61899 (CVSS 7.5) — Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat…
    CVE-2022-46366 (CVSS 9.8) — Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is …
    CVE-2022-31781 (CVSS 7.5) — Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way i…
    CVE-2021-30638 (CVSS 7.5) — Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download…
    CVE-2021-27850 (CVSS 9.8) — A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestr…
    CVE-2020-17531 (CVSS 9.8) — A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deseriali…
    CVE-2020-13953 (CVSS 5.3) — In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-…
    CVE-2019-0207 (CVSS 7.5) — Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextRe…
    CVE-2019-0195 (CVSS 9.8) — Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and …
    CVE-2014-1972 (CVSS 7.8) — Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modifi…

    References

    https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E
    https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High