GHSA-xc66-mg8r-q6r5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xc66-mg8r-q6r5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xc66-mg8r-q6r5/GHSA-xc66-mg8r-q6r5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xc66-mg8r-q6r5
- Aliases
- Published
- 2022-05-17T00:31:42Z
- Modified
- 2025-04-23T02:57:32Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Apache Wicket vulnerable to CSRF attacks
- Details
-
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.
- Database specific
{ "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2025-04-23T02:21:06Z", "nvd_published_at": "2017-10-03T01:29:00Z", "severity": "HIGH" }- References
Affected packages
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core