org.apache.wicket:wicket-core@7.10.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wicket:wicket-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Denial of Service (DoS)

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Denial of Service (DoS). A DNS proxy and possible amplification attack vulnerability in WebClientInfo allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing.

How to fix Denial of Service (DoS)?

Upgrade org.apache.wicket:wicket-core to version 9.3.0, 8.12.0, 7.18.0 or higher.

[9.0.0,9.3.0) [8.0.0,8.12.0) [6.2.0,7.18.0)