-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability involves unsafe deserialization of the 'sp' parameter in Tapestry 3.x. Analysis of similar CVE-2020-17531 (4.x) and Mandiant's technical details indicates that: 1) PageLoader.restorePageFromSerializedData is the logical location for deserializing page state 2) ComponentEventReceiver.handleComponentEvent is the entry point for processing component events containing the 'sp' parameter. Both functions would appear in stack traces when processing malicious requests. Confidence is medium due to lack of direct patch evidence, but supported by vulnerability patterns and disclosure details.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tapestry:tapestry-core | maven | >= 3.0, < 4.0 | 5.0.1 |
KEV Misses 88% of Exploited CVEs- Get the report