CVE-2019-0207: Path Traversal
Published Sep 16, 2019
·Updated
Tapestry processes assets /assets/ctx using classes chain StaticFilesFilter -> AssetDispatcher -> ContextResource, which doesn't filter the character \, so attacker can perform a path traversal attack to read any files on Windows platform.
Affected Software
1 affected component
Apache Tapestry>=5.4.0<=5.4.4
Remediation
Event History
Sep 16, 2019
CVE Published
via MITRE·04:36 PM
Data Sourced
via MITRE·04:36 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-0207?
CVE-2019-0207 is classified as a critical severity vulnerability due to its potential for path traversal attacks.
2
How do I fix CVE-2019-0207?
To mitigate CVE-2019-0207, upgrade Apache Tapestry to a version higher than 5.4.4.
3
What kind of attack does CVE-2019-0207 allow?
CVE-2019-0207 allows attackers to perform path traversal attacks to read arbitrary files on Windows systems.
4
Which versions of Apache Tapestry are affected by CVE-2019-0207?
CVE-2019-0207 affects Apache Tapestry versions from 5.4.0 to 5.4.4.
5
Is CVE-2019-0207 specific to any operating system?
Yes, CVE-2019-0207 is specifically a vulnerability on Windows platforms.