{"id":"CVE-2020-13953","aliases":["EUVD-2022-1222","GHSA-w9mp-p2wp-2xf7"],"status":"published","title":"Improper file downloads in Apache Tapestry","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02651,"percentile":0.85827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2020-09-30T16:51:59Z","modified":"2026-10-24T10:30:46Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","fixed_in":["5.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.6.0"}]}],"versions":["5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.5.0","5.5.0-beta-3"]}],"products":[{"vendor":"apache","product":"tapestry"},{"vendor":"apache software foundation","product":"apache tapestry"}],"references":[{"url":"https://lists.apache.org/thread.html/r50eb12e8a12074a9b7ed63cbab91d180d19cc23dc1da3ed5b6e1280f%40%3Cusers.tapestry.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb%40%3Cusers.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13953","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r37dab61fc7f7088d4311e7f995ef4117d58d86a675f0256caa6991eb@%3Cusers.tapestry.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w9mp-p2wp-2xf7"}],"sources":{"cve":[{"id":"CVE-2020-13953","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2020-09-30T16:51:59Z","modified":"2024-08-04T12:32:14.261Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2022-1222","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2020-09-30T16:51:59Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.099081Z"}],"ghsa":[{"id":"GHSA-w9mp-p2wp-2xf7","title":"Improper file downloads in Apache Tapestry","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2022-02-10T20:35:42Z","modified":"2023-02-01T05:05:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:36:34.917834Z"}],"nvd":[{"id":"CVE-2020-13953","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2020-09-30T18:15:21.317Z","modified":"2026-06-17T02:53:59.233Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-13953","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2020-09-30T18:15:21.317Z","modified":"2026-10-24T10:30:46.785637979Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-w9mp-p2wp-2xf7","title":"Improper file downloads in Apache Tapestry","description":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","status":"published","published":"2022-02-10T20:35:42Z","modified":"2023-11-08T04:02:24.140577Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}