CVE-2020-17531: Deserialization flaw in EOL Tapestry 4.
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-17531?
CVE-2020-17531 is a medium severity vulnerability due to its potential for deserialization attacks.
How do I fix CVE-2020-17531?
To mitigate CVE-2020-17531, it is recommended to upgrade to a version of Apache Tapestry that is not affected, although Tapestry 4 reached end of life in 2008.
Which versions of Apache Tapestry are affected by CVE-2020-17531?
CVE-2020-17531 affects Apache Tapestry versions between 4.0.0 and 5.0.1.
What type of vulnerability is CVE-2020-17531?
CVE-2020-17531 is a Java serialization vulnerability that involves deserialization without proper authentication.
Is there a patch available for CVE-2020-17531?
There is no specific patch for CVE-2020-17531 due to the end of life status of Apache Tapestry 4; upgrading to a newer framework is advised.