GitHub Advisoryadvisory · Maven

GHSA-vfmm-jm4v-7frq Apache Wicket insecure defaults

HIGH Published 2022-05-13 Modified 2025-04-22 Official page ↗
Aliases
CVE-2014-7808
Ecosystem
Maven
Packages
org.apache.wicket:wicket-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326
Reviewed
2025-04-22

Affected packages

• Maven org.apache.wicket:wicket-core: < 1.5.13 → fixed in 1.5.13 • Maven org.apache.wicket:wicket-core: >= 6.0.0-beta1, < 6.19.0 → fixed in 6.19.0 • Maven org.apache.wicket:wicket-core: >= 7.0.0-M1, < 7.0.0-M5 → fixed in 7.0.0-M5

Description

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

Related

Alias · CVE (1)

  • CVE-2014-7808 Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection… vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References