CVE-2021-30638

CVE-2021-30638: An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

Vendor Apache Software Foundation
Product Apache Tapestry
Weakness CWE-200 · Info exposure
Published April 27, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

Key dates

02Disclosure timeline

April 27, 2021 CVE published
August 3, 2024 Record updated