What is GHSA-w9mp-p2wp-2xf7?

GHSA-w9mp-p2wp-2xf7 is a security advisory published by GitHub Security Advisories with Medium severity. Improper file downloads in Apache Tapestry

Which CVE IDs does GHSA-w9mp-p2wp-2xf7 cover?

GHSA-w9mp-p2wp-2xf7 covers the following CVE IDs: CVE-2020-13953. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w9mp-p2wp-2xf7?

GHSA-w9mp-p2wp-2xf7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-w9mp-p2wp-2xf7?

GHSA-w9mp-p2wp-2xf7 affects 1 product, including: maven/org.apache.tapestry:tapestry-core:\u003e= 5.4.0, \u003c 5.6.0.

GHSA-w9mp-p2wp-2xf7MediumCVSS 5.3

Improper file downloads in Apache Tapestry

Vendor

GitHub Security Advisories

Published

February 10, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-13953 →

📋 Description

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.

🎯 Affected products1

maven/org.apache.tapestry:tapestry-core:>= 5.4.0, < 5.6.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-13953
https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E
https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb@%3Cusers.tapestry.apache.org%3E
https://github.com/advisories/GHSA-w9mp-p2wp-2xf7