In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.tapestry:tapestry-core(Maven) | 5.4.0 | 5.6.0 | N/A |
CVSS Metrics
