org.apache.wicket:wicket-core@6.24.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wicket:wicket-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Denial of Service (DoS)

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Denial of Service (DoS). A DNS proxy and possible amplification attack vulnerability in WebClientInfo allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing.

How to fix Denial of Service (DoS)?

Upgrade org.apache.wicket:wicket-core to version 9.3.0, 8.12.0, 7.18.0 or higher.

[9.0.0,9.3.0) [8.0.0,8.12.0) [6.2.0,7.18.0)
  • H
Cross-site Request Forgery (CSRF)

org.apache.wicket:wicket-core Affected versions of Apache Wicket provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

[6.20.0,6.25.0) [7.0.0,7.5.0) [8-alpha,8.0.0-M2)