CVE-2019-10071 is a vulnerability in Apache Tapestry
Published on September 16, 2019
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Products Associated with CVE-2019-10071
Want to know whenever a new CVE is published for Apache Tapestry? stack.watch will email you.
Affected Versions
Apache Tapestry Version Apache Tapestry 5.4.0 to 5.4.3 is affected by CVE-2019-10071Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.