org.apache.wicket:wicket-native-websocket-core 9.0.0

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wicket:wicket-native-websocket-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Insufficient Session Expiration Affected versions of this package are vulnerable to Insufficient Session Expiration via the `getSession(boolean)` method in the native WebSocket `ServletRequestCopy` component. In applications that use native WebSockets on pages or shared resources requiring authentication, an attacker with an open connection can send frames after the container expires, invalidates, logs out, or replaces the authenticated HTTP session. Because the connection continues using the copied Wicket session and its signed-in state, callbacks may authorize those frames as the revoked user, allowing access to protected functionality or actions under that user’s former privileges. Notes At the session-ending step, containers that automatically close WebSocket connections when their HTTP session is destroyed eliminate the open connection needed to send further frames. For Wicket-managed sign-out or invalidation, the stale-session path remains for `WebSocketResource`; a page-bound `WebSocketBehavior` can no longer resolve its page after the page manager is cleared. How to fix Insufficient Session Expiration? Upgrade `org.apache.wicket:wicket-native-websocket-core` to version 8.20.0, 9.25.0, 10.12.0 or higher.	[8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)
L Missing Authorization Affected versions of this package are vulnerable to Missing Authorization via the `onEvent()` dispatch in `WebSocketBehavior`. A client with their own session and page can send text or binary WebSocket messages that invoke `onMessage()` callbacks attached to hidden, disabled, or authorization-restricted components, bypassing the checks applied to Ajax listeners. The callback receives a `WebSocketRequestHandler` it can use to respond to the client, so these component restrictions do not prevent client-triggered callback processing. Notes At the delivery step, client messages reach behaviors only on pages in the attacker’s own session; they do not reach another user’s session, page, or WebSocket connection. The flaw affects client-originated text and binary `onMessage()` callbacks; server-pushed messages and other server notifications are unaffected. How to fix Missing Authorization? Upgrade `org.apache.wicket:wicket-native-websocket-core` to version 8.20.0, 9.25.0, 10.12.0 or higher.	[8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)

Vulnerability

Vulnerable Version

Insufficient Session Expiration

Affected versions of this package are vulnerable to Insufficient Session Expiration via the getSession(boolean) method in the native WebSocket ServletRequestCopy component. In applications that use native WebSockets on pages or shared resources requiring authentication, an attacker with an open connection can send frames after the container expires, invalidates, logs out, or replaces the authenticated HTTP session. Because the connection continues using the copied Wicket session and its signed-in state, callbacks may authorize those frames as the revoked user, allowing access to protected functionality or actions under that user’s former privileges.

Notes

At the session-ending step, containers that automatically close WebSocket connections when their HTTP session is destroyed eliminate the open connection needed to send further frames.
For Wicket-managed sign-out or invalidation, the stale-session path remains for WebSocketResource; a page-bound WebSocketBehavior can no longer resolve its page after the page manager is cleared.

How to fix Insufficient Session Expiration?

Upgrade org.apache.wicket:wicket-native-websocket-core to version 8.20.0, 9.25.0, 10.12.0 or higher.

[8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)

Missing Authorization

Affected versions of this package are vulnerable to Missing Authorization via the onEvent() dispatch in WebSocketBehavior. A client with their own session and page can send text or binary WebSocket messages that invoke onMessage() callbacks attached to hidden, disabled, or authorization-restricted components, bypassing the checks applied to Ajax listeners. The callback receives a WebSocketRequestHandler it can use to respond to the client, so these component restrictions do not prevent client-triggered callback processing.

Notes

At the delivery step, client messages reach behaviors only on pages in the attacker’s own session; they do not reach another user’s session, page, or WebSocket connection.
The flaw affects client-originated text and binary onMessage() callbacks; server-pushed messages and other server notifications are unaffected.

How to fix Missing Authorization?

Upgrade org.apache.wicket:wicket-native-websocket-core to version 8.20.0, 9.25.0, 10.12.0 or higher.

[8.0.0-M1,8.20.0)[9.0.0-M1,9.25.0)[10.0.0-M1,10.12.0)

org.apache.wicket:wicket-native-websocket-core@9.0.0

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically