Information Exposure Affecting org.apache.wicket:wicket-core package, versions [,1.5.12) [6.0.0,6.16.0) [7-alpha,7.0.0-M3)



    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.1% (41st percentile)
Expand this section
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 19 Oct 2015
  • disclosed 19 Oct 2015
  • credit Andrea Del Bene, Martin Grigorov


org.apache.wicket:wicket-core Affected versions of the package are vulnerable to Information Exposure during the Session Handling process.


When rendering a web page Wicket checks the request url against the one at the render time. It is possible the application to change the page parameters (this includes both the query parameters and parameters encoded into the request path). When the requested url differs with the one at the rendering time Wicket stores the response (i.e. the page markup) at the server side and issues an HTTP redirect to the new url. When the second request comes Wicket just flushes the stored response from the first request into the http output stream. This way the browser address bar shows the updated page parameters. When storing the page markup at the server side Wicket uses as an identifier a pair of the current session id plus the new url. However, Wicket does not check if user session is temporary (i.e. sessionId is null). This could lead to a security issue if two or more users with a temporary session are redirected to the same url at the same time. Then user1 might see the markup for user2 which has overridden the markup for user1 while user1 was following the HTTP redirect. In this way user-sensitive informations can be seen by other users.