CVE-2019-0207

Severity CVSS v4.0:
Pending analysis
Type:
CWE-22 Path Traversal
Publication date:
16/09/2019
Last modified:
07/11/2023

Description

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:* 5.4.0 (including) 5.4.4 (including)