PT-2017-5874 · Apache · Apache Wicket

Andrea Del Bene + 1 · Published 2017-10-30 · Updated 2022-05-13 · CVE-2014-3526

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions prior to 1.5.12 Apache Wicket versions 6.x prior to 6.17.0 Apache Wicket versions 7.x prior to 7.0.0-M3

Description: The issue might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Recommendations: For Apache Wicket versions prior to 1.5.12, update to version 1.5.12 or later. For Apache Wicket versions 6.x prior to 6.17.0, update to version 6.17.0 or later. For Apache Wicket versions 7.x prior to 7.0.0-M3, update to version 7.0.0-M3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3526

GHSA-Q7WX-MHX4-JR8Q

Affected Products

Apache Wicket

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3526 · Security Note
• https://osv.dev/vulnerability/GHSA-q7wx-mhx4-jr8q · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3526 · Note
• https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html · Note