CVE-2021-30638

    Dashboard / Vulnerabilities / CVE-2021-30638

    CVE-2021-30638

    Published: 27 Apr 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

    References: http://www.openwall.com/lists/oss-security/2021/04/27/3, https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E, https://security.netapp.com/advisory/ntap-20210528-0004/, https://www.zerodayinitiative.com/advisories/ZDI-21-491/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2672e9847ad56d2b3f83c28319b532b92d6af5c9
    Fixed -465024dec93adbb5e3b910c76a641366e45c58ce

    Affected versions

    5.7.1
    5.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-30638 | CVE-DB