CVE-2016-6806GHSA-XC66-MG8R-Q6R5
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin r
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.25.0, 7.5.0, 8.0.0-M2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Wicket
6.20.0, 6.21.0, 6.22.0, 6.23.0, 6.24.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 8.0.0-M1
- org.apache.wicket:wicket-coreMaven
From 6.20.0 · fixed in 6.25.0
- org.apache.wicket:wicket-coreMaven
From 7.0.0 · fixed in 7.5.0
- org.apache.wicket:wicket-coreMaven
From 8.0.0-M1 · fixed in 8.0.0-M2