CVE Feed

    Dashboard / CVE / CVE-2020-13953

    CVE-2020-13953

    In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.

    Published:Sep 30, 2020
    Last Modified:Nov 21, 2024
    EPS:Sep 30, 2020
    EPSS Score:0.01797
    CVSS Score:5.3

    Affected Products

    Vendor
    Apache
    Product
    Tapestry

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-150 Collect Data from Common Resource Locations
    CAPEC-639 Probe System Files

    Related CVEs

    CVE-2026-61899 (CVSS 7.5) — Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat…
    CVE-2022-46366 (CVSS 9.8) — Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is …
    CVE-2022-31781 (CVSS 7.5) — Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way i…
    CVE-2021-30638 (CVSS 7.5) — Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download…
    CVE-2021-27850 (CVSS 9.8) — A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestr…
    CVE-2020-17531 (CVSS 9.8) — A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deseriali…
    CVE-2019-10071 (CVSS 9.8) — The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing…
    CVE-2019-0207 (CVSS 7.5) — Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextRe…
    CVE-2019-0195 (CVSS 9.8) — Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and …
    CVE-2014-1972 (CVSS 7.8) — Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modifi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High