PT-2017-6111 · Apache · Apache Wicket

Published 2017-09-15 · Updated 2022-05-13 · CVE-2014-7808

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions prior to 1.5.13 Apache Wicket versions 6.x prior to 6.19.0 Apache Wicket versions 7.x prior to 7.0.0-M5

Description: The issue makes it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging the use of CryptoMapper as the default encryption provider.

Recommendations: For Apache Wicket versions prior to 1.5.13, update to version 1.5.13 or later. For Apache Wicket versions 6.x prior to 6.19.0, update to version 6.19.0 or later. For Apache Wicket versions 7.x prior to 7.0.0-M5, update to version 7.0.0-M5 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-310

Related Identifiers

CVE-2014-7808

GHSA-VFMM-JM4V-7FRQ

Affected Products

Apache Wicket

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-7808 · Security Note
• https://osv.dev/vulnerability/GHSA-vfmm-jm4v-7frq · Vendor Advisory
• https://github.com/apache/wicket · Note
• https://github.com/apache/wicket/commit/d2b8848346b8f806e747dca18799d70c37fc893f · Note
• https://web.archive.org/web/20180830051017/https://smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html · Note
• https://smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html · Note
• http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E · Note
• https://lists.apache.org/thread/rqy6lpo5mzco85cbf65r53vdh87gz77b · Note