CVE-2014-1972

High

Published: 22/08/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, allowing remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

Risk Assessment

This vulnerability can lead to serious availability issues for the application and allow attackers to execute unauthorized code, posing a threat to system integrity.

Recommendation

It is recommended to upgrade Apache Tapestry to version 5.3.6 or later to mitigate this vulnerability and implement additional server-side data validation mechanisms.

Other vulnerabilities in Apache Tapestry

CVE-2026-61899High
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download classpath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Original NVD description (English source)

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.