Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2021-23937GHSA-HMHG-95WH-R699

DNS proxy and possible amplification attack

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.3.0, 8.12.0, 7.18.0
None on Exploit-DB, Metasploit or GitHub

Summary

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Apache Software Foundation Apache Wicket

    From Apache Wicket 9.x · through 9.2.0; From Apache Wicket 8.x · through 8.11.0; From Apache Wicket 7.x · through 7.17.0; From 6.2.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0 · fixed in 9.3.0

  • org.apache.wicket:wicket-coreMaven

    From 8.0.0 · fixed in 8.12.0

  • org.apache.wicket:wicket-coreMaven

    fixed in 7.18.0

References 4

lists.apache.org