GitHub Advisoryadvisory · Maven

GHSA-q7wx-mhx4-jr8q Apache Wicket Sensitive Data Exposure

HIGH Published 2022-05-13 Modified 2023-08-07 Official page ↗
Aliases
CVE-2014-3526
Ecosystem
Maven
Packages
org.apache.wicket:wicket-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-07

Affected packages

• Maven org.apache.wicket:wicket-core: < 1.5.12 → fixed in 1.5.12 • Maven org.apache.wicket:wicket-core: >= 6.0, < 6.17.0 → fixed in 6.17.0 • Maven org.apache.wicket:wicket-core: >= 7.0.0-M1, < 7.0.0-M3 → fixed in 7.0.0-M3

Description

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Related

Alias · CVE (1)

  • CVE-2014-3526 Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References