{"id":"CVE-2021-30638","published":"2021-04-27T18:30:15Z","modified":"2024-08-03T22:40:31Z","title":"An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later","vendor":"Apache","product":"Apache Tapestry","tier":"tail","description":{"text":"Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06559,"percentile":0.9379,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2021/04/27/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-491/","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210528-0004/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":18.76}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tapestry","versions":[">= Apache Tapestry, < Apache Tapestry 5.6.4",">= Apache Tapestry, < Apache Tapestry 5.7.2"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","vulnerableRanges":[">=5.4.0, <5.6.4",">=5.7.0, <5.7.2"],"patched":["5.6.4","5.7.2"],"from":["GHSA-ghm8-mmx7-xvg2"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1426","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tapestry-cve-2020-13953","parents":[{"from":"CVE-2020-13953","to":"CVE-2021-30638","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This was caused by an incomplete fix for CVE-2020-13953.","from":"CVE.org","in":"CVE-2021-30638"},{"kind":"similar","provenance":"machine","score":0.37,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2019-10071","published":"2019-09-16","fixed":"5.4.5","kev":false},{"cve":"CVE-2020-13953","published":"2020-09-30","fixed":"5.6.0","kev":false},{"cve":"CVE-2021-27850","published":"2021-04-15","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2021-27850","to":"CVE-2021-30638","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tapestry:tapestry-core","fromFixed":"5.6.3","toFixed":"5.6.4","daysApart":12}]}},{"cve":"CVE-2021-30638","published":"2021-04-27","fixed":"5.7.2","kev":false},{"cve":"CVE-2022-31781","published":"2022-07-13","fixed":"5.8.2","kev":false,"link":{"from":"CVE-2021-30638","to":"CVE-2022-31781","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tapestry:tapestry-core","fromFixed":"5.7.2","toFixed":"5.8.2","daysApart":442}]}}],"package":"Maven:org.apache.tapestry:tapestry-core"}}