Vulnerability in Apache Tapestry
CVE-2014-1972
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.8 (High). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.096 (95.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.096 · newest: 0.096 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tapestry.apache.org/release-notes-536.html (Vendor Advisory)
- issues.apache.org/jira/browse/TAP5-2008
- jvn.jp/en/jp/JVN17611367/index.html (Vendor Advisory, third-party-advisory)
- jvndb.jvn.jp/jvndb/JVNDB-2015-000118 (Vendor Advisory, third-party-advisory)
- www.openwall.com/lists/oss-security/2019/08/23/5 (mailing-list)
- seclists.org/fulldisclosure/2019/Aug/20 (mailing-list)
- lists.apache.org/thread.html/84e99dedad2ecb4676de93c3ab73a8a10882951ab6984f5147… (mailing-list)
- lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec89613… (mailing-list)
- lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068… (mailing-list)
- lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f… (mailing-list)
Frequently asked questions
- What is CVE-2014-1972?
- CVE-2014-1972 is a vulnerability in Apache Tapestry, classified under CWE-399. Published 2015-08-22.
- Is CVE-2014-1972 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.