Intrusion PreventionApache.Tapestry.ContextAssetRequest.Information.Disclosure
Description
This indicates an attack attempt to exploit an Information Disclosure Vulnerability in Apache Software Foundation Tapestry.
A remote attacker can exploit this vulnerability by sending a crafted HTTP request containing URL-encoded slash characters preceding the blacklisted paths such as WEB-INF and META-INF to the vulnerable server. Successful exploitation could result in the exfiltration of web application sources, classes and property files.
Affected Products
Apache Software Foundation Tapestry 5.4.0 to 5.5.0
Impact
Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 49530 |
| Created | Oct 08, 2020 |
| Updated | May 17, 2021 |
| Risk |
|
| CVE ID | CVE-2021-30638 CVE-2020-13953 |
| Exploit Prediction Score | 0.66% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, BSD, Solaris |
| Affected App | Apache |