Apache Tapestry Unsafe Object Storage

2022-05-1301:26:11

Google

osv.dev

0.027 Low

EPSS

Percentile

90.5%

JSON

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

CPENameOperatorVersion
org.apache.tapestry:tapestry-coreeq5.2.5
org.apache.tapestry:tapestry-coreeq5.3.5
org.apache.tapestry:tapestry-coreeq5.3.2
org.apache.tapestry:tapestry-coreeq5.2.2
org.apache.tapestry:tapestry-coreeq5.1.0.4
org.apache.tapestry:tapestry-coreeq5.1.0.5
org.apache.tapestry:tapestry-coreeq5.0.17
org.apache.tapestry:tapestry-coreeq5.0.15
org.apache.tapestry:tapestry-coreeq5.0.13
org.apache.tapestry:tapestry-coreeq5.0.11

Name	Operator	Version
org.apache.tapestry:tapestry-core	eq	5.2.5
org.apache.tapestry:tapestry-core	eq	5.3.5
org.apache.tapestry:tapestry-core	eq	5.3.2
org.apache.tapestry:tapestry-core	eq	5.2.2
org.apache.tapestry:tapestry-core	eq	5.1.0.4
org.apache.tapestry:tapestry-core	eq	5.1.0.5
org.apache.tapestry:tapestry-core	eq	5.0.17
org.apache.tapestry:tapestry-core	eq	5.0.15
org.apache.tapestry:tapestry-core	eq	5.0.13
org.apache.tapestry:tapestry-core	eq	5.0.11