Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure

Summaryinfo

A vulnerability marked as problematic has been reported in Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2014-3526. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2. It has been rated as problematic. This issue affects an unknown code of the component Session Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

The bug was discovered 09/22/2014. The weakness was released 10/30/2017 (Website). It is possible to read the advisory at wicket.apache.org. The identification of this vulnerability is CVE-2014-3526 since 05/14/2014. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 1134 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.5.12, 6.17.0 or 7.0.0-M3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Wicket

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 7.0.0-M2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion