Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper cryptographic issue

Summaryinfo

A vulnerability described as problematic has been identified in Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4. This impacts an unknown function of the component CryptoMapper. Executing a manipulation can lead to cryptographic issue. This vulnerability is registered as CVE-2014-7808. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4. It has been declared as critical. This vulnerability affects an unknown code block of the component CryptoMapper. The manipulation with an unknown input leads to a cryptographic issue vulnerability. The CWE definition for the vulnerability is CWE-310. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

The bug was discovered 02/18/2015. The weakness was published 09/15/2017 (Website). The advisory is shared for download at mail-archives.apache.org. This vulnerability was named CVE-2014-7808 since 10/03/2014. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability was handled as a non-public zero-day exploit for at least 940 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.5.13, 6.19.0 or 7.0.0-M5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• Wicket

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 1.5.12
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 7.0.0-M4

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion