CVE-2020-13953 Improper file downloads in Apache Tapestry
Attackers can download sensitive files from the WEB-INF directory by crafting specific URLs in Apache Tapestry applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13953?
CVE-2020-13953 is a medium-severity path traversal vulnerability in Apache Tapestry, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Weakness: CWE-552
Which versions are affected by CVE-2020-13953?
2 open source packages ship an affected version, including org.apache.tapestry:tapestry-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tapestry:tapestry-core Maven | From 5.4.0 | 5.6.0 |
org.apache.tapestry:tapestry-core Maven | From 5.4.0 | 5.6.0 |
Products include Apache Tapestry.
How do I fix CVE-2020-13953?
Upgrade org.apache.tapestry:tapestry-core to 5.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-13953 being exploited?
There is no known exploitation of CVE-2020-13953 in the wild and no public exploit code.
Other vulnerabilities in Apache Tapestry
- CVE-2022-46366 Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
- CVE-2021-27850 Bypass of the fix for CVE-2019-0195
- CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.
- CVE-2019-0195 Deserialization of Untrusted Data in Apache Tapestry
- CVE-2019-10071 Timing attack on HMAC signature comparison in Apache Tapestry
Sources
Also known as GHSA-w9mp-p2wp-2xf7.