Deserialization flaw in EOL Tapestry 4.
CVE-2020-17531

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Tapestry
Vendor
CVE Published:
8 December 2020

Badges

👾 Exploit Exists🟣 EPSS 36%

What is CVE-2020-17531?

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Tapestry Apache Tapestry 4 <= 4

References

https://lists.apache.org/thread.html/r700a6aa234dbff0555d...
https://lists.apache.org/thread.html/r700a6aa234dbff0555d...
mailing-list
https://security.netapp.com/advisory/ntap-20210115-0007/

EPSS Score

36% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Tapestry would like to thank Adrian Bravo (@adrianbravon) for reporting this issue.
JSON
.