PT-2017-5768 · Apache · Apache Wicket

Published 2017-10-02 · Updated 2022-05-17 · CVE-2014-0043

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions 1.5.10 through 6.13.0

Description: The issue allows an attacker to check for the existence of particular classes in the classpath by issuing requests to special URLs handled by Wicket. This can be used to determine whether a third-party library with a known security issue is in use.

Recommendations: For Apache Wicket version 1.5.10, update to a version where this issue is fixed. For Apache Wicket version 6.13.0, update to a version where this issue is fixed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-0043

GHSA-244G-8368-6WR9

Affected Products

Apache Wicket

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-0043 · Security Note
• https://osv.dev/vulnerability/GHSA-244g-8368-6wr9 · Vendor Advisory
• https://github.com/apache/wicket · Note
• https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d@1392986987@%3Cannounce.wicket.apache.org%3E · Note
• https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d%401392986987%40%3Cannounce.wicket.apache.org%3E · Note