CVE-2014-1972

描述

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

如何修補 CVE-2014-1972

要修補 CVE-2014-1972,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tapestry:tapestry-core—升級至 5.3.6 或更新版本

CVE-2014-1972 正在被利用嗎?

中等 — EPSS 為 9.6%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 5.3.6

參考連結(13)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-1972
• WEBjvn.jp/en/jp/JVN17611367/index.html
• WEBjvndb.jvn.jp/jvndb/JVNDB-2015-000118
• WEBseclists.org/fulldisclosure/2019/Aug/20
• WEBwww.openwall.com