VulnerabilityModified

CVE-2019-10071

This could lead to remote code execution if an attacker is able to determine the correct signature for their payload.

CRITICAL 9.8EPSS 8.75%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 8.75% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-203
Affected: apache/tapestry
Source: security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.