cve.bz

CVE-2021-30638

7.5 highEPSS 6.6%

High (7.5) in apache tapestry. EPSS 6.6% chance of exploitation in the next 30 days. Fixed in org.apache.tapestry:tapestry-core 5.6.4, 5.7.2.

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
6.6% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs
CWE-863, CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-ghm8-mmx7-xvg2Mavenorg.apache.tapestry:tapestry-core>=5.4.0 <5.6.45.6.4
GHSA-ghm8-mmx7-xvg2Mavenorg.apache.tapestry:tapestry-core>=5.7.0 <5.7.25.7.2

References

Check your stackJSON