GitHub Advisoryadvisory · Maven

GHSA-xc66-mg8r-q6r5 Apache Wicket vulnerable to CSRF attacks

HIGH Published 2022-05-17 Modified 2025-04-23 Official page ↗
Aliases
CVE-2016-6806
Ecosystem
Maven
Packages
org.apache.wicket:wicket-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-04-23

Affected packages

• Maven org.apache.wicket:wicket-core: >= 6.20.0, < 6.25.0 → fixed in 6.25.0 • Maven org.apache.wicket:wicket-core: >= 7.0.0, < 7.5.0 → fixed in 7.5.0 • Maven org.apache.wicket:wicket-core: >= 8.0.0-M1, < 8.0.0-M2 → fixed in 8.0.0-M2

Description

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

Related

Alias · CVE (1)

  • CVE-2016-6806 Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References