CVE-2016-6806

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-6806
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6806.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-6806
Aliases
Published
2017-10-03T01:29:00.967Z
Modified
2026-07-08T12:42:00.974002Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

References

Affected packages

Git / github.com/apache/wicket

Affected ranges

Type
GIT
Repo
https://github.com/apache/wicket
Events
Introduced
1533356d83d95e691ba898123ee299d3d12f4a1a
Last affected
3c0a1f5e1481eb6418d67a423ae0190ba79a49f1
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:wicket:6.20.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:6.21.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:6.22.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:6.23.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:6.24.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:7.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:7.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:7.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:7.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:8.0.0:m1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "6.20.0"
        },
        {
            "last_affected": "6.20.0"
        },
        {
            "introduced": "6.21.0"
        },
        {
            "last_affected": "6.21.0"
        },
        {
            "introduced": "6.22.0"
        },
        {
            "last_affected": "6.22.0"
        },
        {
            "introduced": "6.23.0"
        },
        {
            "last_affected": "6.23.0"
        },
        {
            "introduced": "6.24.0"
        },
        {
            "last_affected": "6.24.0"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "7.1.0"
        },
        {
            "last_affected": "7.1.0"
        },
        {
            "introduced": "7.2.0"
        },
        {
            "last_affected": "7.2.0"
        },
        {
            "introduced": "7.3.0"
        },
        {
            "last_affected": "7.3.0"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "last_affected": "7.4.0"
        },
        {
            "introduced": "8.0.0-m1"
        },
        {
            "last_affected": "8.0.0-m1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*
6.20.0
6.21.0
6.22.0
6.23.0
6.24.0
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
8.*
8.0.0-m1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6806.json"