{"id":"CVE-2020-13953","published":"2020-09-30T16:51:59Z","modified":"2024-08-04T12:32:14Z","title":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02651,"percentile":0.85574,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":17.11}]},"affectedVersions":[{"vendor":"n/a","product":"Apache Tapestry","versions":["Apache Tapestry from 5.4.0 to 5.5.0"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","vulnerableRanges":[">=5.4.0, <5.6.0"],"patched":["5.6.0"],"from":["GHSA-w9mp-p2wp-2xf7"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1222","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tapestry-cve-2020-13953","children":[{"from":"CVE-2020-13953","to":"CVE-2021-30638","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This was caused by an incomplete fix for CVE-2020-13953.","from":"CVE.org","in":"CVE-2021-30638"},{"kind":"similar","provenance":"machine","score":0.37,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2019-0195","published":"2019-09-16","fixed":"5.4.5","kev":false},{"cve":"CVE-2019-0207","published":"2019-09-16","fixed":"5.4.5","kev":false},{"cve":"CVE-2019-10071","published":"2019-09-16","fixed":"5.4.5","kev":false,"link":{"from":"CVE-2019-10071","to":"CVE-2020-13953","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tapestry:tapestry-core","fromFixed":"5.4.5","toFixed":"5.6.0","daysApart":380}]}},{"cve":"CVE-2020-13953","published":"2020-09-30","fixed":"5.6.0","kev":false},{"cve":"CVE-2021-27850","published":"2021-04-15","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2020-13953","to":"CVE-2021-27850","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tapestry:tapestry-core","fromFixed":"5.6.0","toFixed":"5.6.3","daysApart":197}]}},{"cve":"CVE-2021-30638","published":"2021-04-27","fixed":"5.7.2","kev":false},{"cve":"CVE-2022-31781","published":"2022-07-13","fixed":"5.8.2","kev":false}],"package":"Maven:org.apache.tapestry:tapestry-core"}}