PT-2017-9021 · Apache · Apache Wicket

Publicado 2017-10-02 · Atualizado 2022-05-17 · CVE-2016-6806

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.x through 6.24.0 Apache Wicket versions 7.x through 7.4.0 Apache Wicket version 8.0.0-M1

Description The issue concerns a CSRF prevention measure that fails to identify certain cross-origin requests. This is because it only checks the Origin HTTP header and does not account for the Referer HTTP header when the Origin header is not provided. Additionally, not all server-side targets were subject to the CSRF check.

Recommendations For Apache Wicket versions 6.x through 6.24.0, update to version 6.25.0 or later to resolve the issue. For Apache Wicket versions 7.x through 7.4.0, update to version 7.5.0 or later to resolve the issue. For Apache Wicket version 8.0.0-M1, ensure that the CSRF prevention measure is updated to check both the Origin and Referer HTTP headers, and apply the CSRF check to all server-side targets.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-6806

GHSA-XC66-MG8R-Q6R5

Produtos afetados

Apache Wicket

Referências · 6

• https://github.com/apache/wicket · Nota
• https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E · Nota
• https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd@%3Cannounce.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6806 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xc66-mg8r-q6r5 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6806 · Aviso do Fabricante