PT-2017-5874 · Apache · Apache Wicket

Andrea Del Bene + 1 · Publicado 2017-10-30 · Atualizado 2022-05-13 · CVE-2014-3526

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions prior to 1.5.12 Apache Wicket versions 6.x prior to 6.17.0 Apache Wicket versions 7.x prior to 7.0.0-M3

Description: The issue might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Recommendations: For Apache Wicket versions prior to 1.5.12, update to version 1.5.12 or later. For Apache Wicket versions 6.x prior to 6.17.0, update to version 6.17.0 or later. For Apache Wicket versions 7.x prior to 7.0.0-M3, update to version 7.0.0-M3 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3526

GHSA-Q7WX-MHX4-JR8Q

Produtos afetados

Apache Wicket

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3526 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3526 · Nota
• https://osv.dev/vulnerability/GHSA-q7wx-mhx4-jr8q · Aviso do Fabricante
• https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html · Nota