CVE-2020-17531: Serialization vulnerability in Apache Tapestry
Summary
CVE-2020-17531: Serialization vulnerability in Apache Tapestry. Affects org.apache.tapestry:tapestry-project versions >= 4.0, < 5.0.1. Fixed in 5.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tapestry is a Java-based open-source framework for creating dynamic, robust, and scalable web applications. It provides a component-oriented architecture and a powerful templating engine. The vulnerability identified as CVE-2020-17531 affects Apache Tapestry 4, which reached end of life in 2008. This version of Apache Tapestry attempts to deserialize the "sp" parameter before invoking the page's validate method, allowing for deserialization without authentication. It is important to note that Apache Tapestry 5 versions are not vulnerable to this issue.
Vulnerability Detail
The vulnerability in Apache Tapestry 4 allows for unauthorized deserialization due to the improper handling of Java Serialization. By exploiting this vulnerability, an attacker can execute arbitrary code on the affected system, potentially leading to remote code execution, information disclosure, or other malicious activities. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The recommended solution is to upgrade to Apache Tapestry 5.
Conclusion
The identified vulnerability in Apache Tapestry 4 allows for unauthorized deserialization, potentially leading to remote code execution or information disclosure. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tapestry:tapestry-project →
FAQ
Apache Tapestry is a Java-based open-source framework for building web applications. It follows a component-oriented architecture and provides a powerful templating engine.
Only Apache Tapestry 4 versions are affected. Apache Tapestry 5 versions are not vulnerable to this issue.
Exploiting this vulnerability can lead to remote code execution, information disclosure, or other malicious activities on the affected system.
No, there is no fix available for Apache Tapestry 4. Users are advised to upgrade to Apache Tapestry 5 to mitigate the vulnerability.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
