CVE-2014-3526

Published: Oct 30, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Affected (26)

Products: Apache: Wicket

Apache

1 product

Wicket

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Apache Wicket	From 1.5.0 to 1.5.12
Apache Wicket	Version 6.0.0
Apache Wicket	Version 6.0.0 beta1
Apache Wicket	Version 6.0.0 beta2
Apache Wicket	Version 6.0.0 beta3
Apache Wicket	Version 6.1.0
Apache Wicket	Version 6.1.1
Apache Wicket	Version 6.10.0
Apache Wicket	Version 6.11.0
Apache Wicket	Version 6.12.0
Apache Wicket	Version 6.13.0
Apache Wicket	Version 6.14.0
Apache Wicket	Version 6.15.0
Apache Wicket	Version 6.16.0
Apache Wicket	Version 6.2.0
Apache Wicket	Version 6.3.0
Apache Wicket	Version 6.4.0
Apache Wicket	Version 6.5.0
Apache Wicket	Version 6.6.0
Apache Wicket	Version 6.7.0
Apache Wicket	Version 6.8.0
Apache Wicket	Version 6.9.0
Apache Wicket	Version 6.9.1
Apache Wicket	Version 7.0.0
Apache Wicket	Version 7.0.0 milestone1
Apache Wicket	Version 7.0.0 milestone2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.