{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000118.html",
  "dc:date": "2015-08-26T17:51+09:00",
  "dcterms:issued": "2015-08-20T15:53+09:00",
  "dcterms:modified": "2015-08-26T17:51+09:00",
  "description": "Apache Tapestry contains a vulnerability where it may deserialize untrusted data.\r\n\r\nApache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the server. This data serialization / deserialization process does not contain data validation. Therefore, if the serialized data is altered, the server will deserailze data without validating the data (CWE-502).\r\n\r\nTakeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000118.html",
  "sec:cpe": {
    "#text": "cpe:/a:apache:tapestry",
    "@product": "Apache Tapestry",
    "@vendor": "Apache Software Foundation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2015-000118",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN17611367/index.html",
      "@id": "JVN#17611367",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1972",
      "@id": "CVE-2014-1972",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1972",
      "@id": "CVE-2014-1972",
      "@source": "NVD"
    },
    {
      "#text": "https://www.jpcert.or.jp/securecoding/2014/OracleJava-AtomicReferenceArray.pdf",
      "@id": "OracleJava-AtomicReferenceArray.pdf",
      "@source": "JPCERT"
    },
    {
      "#text": "https://www.securecoding.cert.org/confluence/display/java/SER02-J.+Sign+then+seal+sensitive+objects+before+sending+them+outside+a+trust+boundary;jsessionid=6418285E96FE6503CBFF59A54A87B1E7",
      "@id": "SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary",
      "@source": "Related Information"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Apache Tapestry deserializes untrusted data"
}