CVE-2014-1972
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
- EPSS
- 9.6% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tapestry
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c438-8cvq-pxxx | Maven | org.apache.tapestry:tapestry-core | <5.3.6 | 5.3.6 |