Apache Tapestry Unauthenticated RCE (CVE-2019-0195, CVE-2021-27850)

Description

Acunetix has detected that the web application is based on Apache Tapestry. Apache Tapestry has a vulnerability that allows an unauthenticated user to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker can use it to achieve RCE on the server.

Remediation

Upgrade to the latest version of Apache Tapestry

References

Related Vulnerabilities

Severity

High

Classification

CVE-2021-27850 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution