CVE-2020-17531 is a critical Java deserialization vulnerability affecting Apache Tapestry 4, allowing unauthenticated attackers to execute arbitrary code by manipulating the "sp" parameter before validation. With a CVSS score of 9.8 (CRITICAL), this flaw presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Apache Tapestry 4 reached end-of-life in 2008, meaning no official patch will be released, and users are strongly advised to upgrade to Apache Tapestry 5. While there is no known active exploitation, public exploit code, or significant community discussion, the high FAUCET Risk Score and EPSS indicate its potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.0.0, < 5.0.1CPE matchmatch criteria | cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.