{"metadata": {"vulnerability": "cve-2019-0195", "count": 16, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2018-11-14T00:00:00Z", "date_only": false, "value": "2018-11-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2019-0195", "field": "cveMetadata.dateReserved"}, {"timestamp": "2019-09-16T00:00:00Z", "date_only": true, "value": "2019-09-16", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2019-0195", "record": "GSD-2019-0195", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2019-09-16T15:37:37Z", "date_only": false, "value": "2019-09-16T15:37:37.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2019-0195", "field": "cveMetadata.datePublished"}, {"timestamp": "2019-09-16T16:15:00Z", "date_only": false, "value": "2019-09-16T16:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6MWH-FW4P-75FJ", "record": "GHSA-6MWH-FW4P-75FJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2019-09-16T16:15:00Z", "date_only": false, "value": "2019-09-16T16:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2019-0195", "record": "GSD-2019-0195", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2019-09-16T16:15:10.007Z", "date_only": false, "value": "2019-09-16T16:15:10.007", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2019-0195", "record": "FKIE_CVE-2019-0195", "field": "published"}, {"timestamp": "2019-10-07T00:00:00Z", "date_only": true, "value": "2019-10-07", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2019-0195", "record": "GSD-2019-0195", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2021-04-15T11:06:14Z", "date_only": false, "value": "2021-04-15T11:06:14.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "cve-2019-0195", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-04-19T20:06:00Z", "date_only": false, "value": "2021-04-19T20:06Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2019-0195", "record": "GSD-2019-0195", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-05-24T22:00:35Z", "date_only": false, "value": "2022-05-24T22:00:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6MWH-FW4P-75FJ", "record": "GHSA-6MWH-FW4P-75FJ", "field": "published"}, {"timestamp": "2022-11-03T18:45:32Z", "date_only": false, "value": "2022-11-03T18:45:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6MWH-FW4P-75FJ", "record": "GHSA-6MWH-FW4P-75FJ", "field": "modified"}, {"timestamp": "2023-11-17T07:08:00Z", "date_only": false, "value": "2023-11-17T07:08:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/arpsyndicate/228", "record": "CVE-2019-0195", "field": "creation_timestamp", "uuid": "d81db63b-6ff6-4180-973f-8d603ca8965b", "content": "#ExploitObserverAlert\n\nCVE-2021-27850\n\nDESCRIPTION: Exploit Observer has 14 entries related to CVE-2021-27850. A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.\n\nFIRST-EPSS: 0.974140000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/228"}, {"timestamp": "2023-12-13T01:23:38.947Z", "date_only": false, "value": "2023-12-13T01:23:38.947589Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2019-0195", "record": "GSD-2019-0195", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-04T17:44:15.351Z", "date_only": false, "value": "2024-08-04T17:44:15.351Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2019-0195", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-04T17:44:15.351Z", "date_only": false, "value": "2024-08-04T17:44:15.351Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2019-0195", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T02:07:55.960Z", "date_only": false, "value": "2026-06-17T02:07:55.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2019-0195", "record": "FKIE_CVE-2019-0195", "field": "lastModified"}]}