Homepage
About Snyk

org.apache.wicket:wicket-core@7.16.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wicket:wicket-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Denial of Service (DoS)

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Denial of Service (DoS). A DNS proxy and possible amplification attack vulnerability in WebClientInfo allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing.

How to fix Denial of Service (DoS)?

Upgrade org.apache.wicket:wicket-core to version 9.3.0, 8.12.0, 7.18.0 or higher.

[9.0.0,9.3.0) [8.0.0,8.12.0) [6.2.0,7.18.0)
  • M
Information Disclosure

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Information Disclosure. By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering.

How to fix Information Disclosure?

Upgrade org.apache.wicket:wicket-core to version 7.17.0, 8.9.0, 9.0.0 or higher.

[7.16.0,7.17.0) [8.8.0,8.9.0) [9.0.0-M5,9.0.0)
Go back to all versions of this package