CVE-2020-13953 | Apache Tapestry WEB-INFÎļþÏÂÔØÎó²îͨ¸æ

Ðû²¼Ê±¼ä 2020-09-27

0x00 Îó²î¸ÅÊö

CVE  ID

CVE-2020-13953

ʱ   ¼ä

2020-09-27

Àà   ÐÍ


µÈ   ¼¶

ÖÐΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£

Tapestry 5.4.0-5.5.0


Apache TapestryÊÇÒ»¸öʹÓÃJavaÓïÑÔ±àдµÄ¿ªÔ´¿ò¼Ü£¬£¬£¬£¬£¬£¬£¬£¬ÓÃÓÚ½¨É趯̬µÄ¡¢½áʵµÄ¡¢¸ßÎÞаÐÔµÄwebÓ¦ÓóÌÐò¡£¡£¡£¡£¡£¡£Tapestry¿ò¼ÜÐÞ½¨ÔÚ±ê×¼µÄJava Servlet APIÖ®ÉÏ£¬£¬£¬£¬£¬£¬£¬£¬Òò´ËËüÄܹ»ºÜºÃµØ¼æÈÝÈκÎservletÈÝÆ÷»òÕßÓ¦ÓÃЧÀÍ¡£¡£¡£¡£¡£¡£Tapestry¾ßÓÐÐí¶àÇå¾²¹¦Ð§£¬£¬£¬£¬£¬£¬£¬£¬Ö¼ÔÚÔöÇ¿Ó¦ÓóÌÐòÃâÊܲ»ÐëÒªµÄÈëÇֺ;ܾøЧÀ͵ÄË𺦡£¡£¡£¡£¡£¡£

0x01 Îó²îÏêÇé

ͼƬ.png

 

2020Äê09ÔÂ26ÈÕ£¬£¬£¬£¬£¬£¬£¬£¬Apache TapestryÖб»Ì»Â¶³ö±£´æÒ»¸öÎļþÏÂÔØÎó²î¡£¡£¡£¡£¡£¡£Îó²î×·×ÙΪCVE-2020-13953£¬£¬£¬£¬£¬£¬£¬£¬ÆäÎó²îÆ·¼¶ÎªÖÐΣ¡£¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý¶ñÒâµÄURLÏÂÔØWEB-INFÖеÄÎļþ¡£¡£¡£¡£¡£¡£


0x02 ´¦Öóͷ£½¨Òé

½«Apache TapestryÉý¼¶µ½ 5.6.0»ò¸ü¸ß°æ±¾¡£¡£¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://tapestry.apache.org/download.html

0x03 ²Î¿¼Á´½Ó

https://www.mail-archive.com/users@tapestry.apache.org/msg77276.html

https://seclists.org/oss-sec/2020/q3/197

https://tapestry.apache.org/security.html

0x04 ʱ¼äÏß

2020-09-26  ApacheÐû²¼Ç徲ͨ¸æ

2020-09-27  VSRCÐû²¼Ç徲ͨ¸æ

0x05 ¸½Â¼

CVSSÆÀ·Ö±ê×¼¹ÙÍø£ºhttp://www.first.org/cvss/



ͼƬ.png