cve.bz

CVE-2020-17531

9.8 criticalEPSS 10.0%

Critical (9.8) in apache tapestry. EPSS 10.0% chance of exploitation in the next 30 days. Fixed in org.apache.tapestry:tapestry-project 5.0.1.

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
10.0% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-c566-2grg-mjwgMavenorg.apache.tapestry:tapestry-project>=4.0 <5.0.15.0.1

References

Check your stackJSON