Apache Tiles vulnerabilities

2 CVEs affecting Apache Tiles, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-49735, published 2023-11-30.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2009-1275, published 2009-04-09. Medium severity, CVSS 6.8. EPSS: 2.8% chance of exploitation in the next 30 days. Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct…
• CVE-2023-49735, published 2023-11-30. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path…