CVE-2020-17531

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

• CWE-502
• CWE-502

• http://www.openwall.com/lists/oss-security/2022/12/02/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210115-0007/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/02/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3EMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210115-0007/Third Party Advisory

Published

Dec 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17526Incorrect Session Validation in Apache Airflow Webserver ver…7.7
• CVE-2020-17527While investigating bug 64830 it was discovered that Apache …7.5
• CVE-2020-17528Out-of-bounds Write vulnerability in TCP stack of Apache Nut…9.1
• CVE-2020-17529Out-of-bounds Write vulnerability in TCP Stack of Apache Nut…9.8
• CVE-2020-1753A security flaw was found in Ansible Engine, all Ansible 2.7…5.5
• CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in …9.8
• CVE-2020-17532When handler-router component is enabled in servicecomb-java…8.8
• CVE-2020-17533Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.…8.1
• CVE-2020-17534There exists a race condition between the deletion of the te…7
• CVE-2020-17535Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17536Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17537Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…