PT-2017-5768 · Apache · Apache Wicket

Publicado 2017-10-02 · Atualizado 2022-05-17 · CVE-2014-0043

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions 1.5.10 through 6.13.0

Description: The issue allows an attacker to check for the existence of particular classes in the classpath by issuing requests to special URLs handled by Wicket. This can be used to determine whether a third-party library with a known security issue is in use.

Recommendations: For Apache Wicket version 1.5.10, update to a version where this issue is fixed. For Apache Wicket version 6.13.0, update to a version where this issue is fixed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-0043

GHSA-244G-8368-6WR9

Produtos afetados

Apache Wicket

Referências · 5

• https://github.com/apache/wicket · Nota
• https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d@1392986987@%3Cannounce.wicket.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0043 · Nota de Segurança
• https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d%401392986987%40%3Cannounce.wicket.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-244g-8368-6wr9 · Aviso do Fabricante