PT-2017-9021 · Apache · Apache Wicket

Published 2017-10-02 · Updated 2022-05-17 · CVE-2016-6806

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.x through 6.24.0 Apache Wicket versions 7.x through 7.4.0 Apache Wicket version 8.0.0-M1

Description The issue concerns a CSRF prevention measure that fails to identify certain cross-origin requests. This is because it only checks the Origin HTTP header and does not account for the Referer HTTP header when the Origin header is not provided. Additionally, not all server-side targets were subject to the CSRF check.

Recommendations For Apache Wicket versions 6.x through 6.24.0, update to version 6.25.0 or later to resolve the issue. For Apache Wicket versions 7.x through 7.4.0, update to version 7.5.0 or later to resolve the issue. For Apache Wicket version 8.0.0-M1, ensure that the CSRF prevention measure is updated to check both the Origin and Referer HTTP headers, and apply the CSRF check to all server-side targets.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-6806

GHSA-XC66-MG8R-Q6R5

Affected Products

Apache Wicket

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-6806 · Security Note
• https://osv.dev/vulnerability/GHSA-xc66-mg8r-q6r5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6806 · Vendor Advisory
• https://github.com/apache/wicket · Note
• https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd@%3Cannounce.apache.org%3E · Note