org.apache.wicket:wicket-core@6.8.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wicket:wicket-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Denial of Service (DoS)

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Denial of Service (DoS). A DNS proxy and possible amplification attack vulnerability in WebClientInfo allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing.

How to fix Denial of Service (DoS)?

Upgrade org.apache.wicket:wicket-core to version 9.3.0, 8.12.0, 7.18.0 or higher.

[9.0.0,9.3.0) [8.0.0,8.12.0) [6.2.0,7.18.0)
  • M
Cross-site Scripting (XSS)

org.apache.wicket:wicket-core Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.

[1.5.0,1.5.15) [6.0.0,6.22.0) [7.0.0,7.2.0)
  • M
Information Exposure

org.apache.wicket:wicket-core Affected versions of the package are vulnerable to Information Exposure. By issuing requests to special urls handled by Wicket it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.

[,1.5.11) [6.0.0,6.14.0)
  • H
Inadequate Encryption Strength

org.apache.wicket:wicket-core Affected versions of the package are vulnerable to Inadequate Encryption Strength. With Wicket's default security settings the usage of CryptoMapper to encrypt/obfuscate pages' urls is not strong enough. It is possible to predict the encrypted version of an url based on the previous history.

[,1.5.13) [6.0.0,6.19.0) [7-alpha,7.0.0-M5)
  • H
Information Exposure

org.apache.wicket:wicket-core Affected versions of the package are vulnerable to Information Exposure during the Session Handling process.

[,1.5.12) [6.0.0,6.16.0) [7-alpha,7.0.0-M3)