CVE-2014-0043 Apache Wicket allows attackers to check for third-party libraries
MediumCVSS 5.3
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.wicket/wicket-core(Maven) | >= 1.5-RC1, < 1.5.11 | 1.5.11 |
| org.apache.wicket/wicket-core(Maven) | = 1.5-RC1 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5-RC3 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5-RC4.2 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5-RC5.1 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5-RC7 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5-rc2 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.1 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.10 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.2 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.3 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.4 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.5 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.6 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.7 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.8 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 1.5.9 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | >= 6.0.0-beta1, < 6.14.0 | 6.14.0 |
| org.apache.wicket/wicket-core(Maven) | = 6.0.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.0.0-beta1 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.0.0-beta2 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.0.0-beta3 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.1.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.1.1 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.wicket/wicket-core(Maven) | = 6.10.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.11.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.12.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.13.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.2.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.3.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.4.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.5.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.6.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.7.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.8.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.9.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | = 6.9.1 | No fix listed |
| apache wicket | = 1.5.10 | No fix listed |
| apache wicket | = 6.13.0 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | >= 1.5-RC1, <= 1.5.10 | No fix listed |
| org.apache.wicket/wicket-core(Maven) | >= 6.0.0-beta1, <= 6.13.0 | No fix listed |
| Apache Wicket | = 1.5.10 | No fix listed |
| Apache Wicket | = 6.13.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- lists.apache.org
- [wicket-announce] 20140221 CVE-2014-0043 mailing-list
- github.com