CVE-2014-7808

Published: Sep 15, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

Affected (7)

Products: Apache: Wicket

Apache

1 product

Wicket

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Apache Wicket	1.5.0 ≤ version < 1.5.13
Apache Wicket	6.0.0 ≤ version < 6.19.0
Apache Wicket	Version 7.0.0 milestone1
Apache Wicket	Version 7.0.0 milestone2
Apache Wicket	Version 7.0.0 milestone3
Apache Wicket	Version 7.0.0 milestone4
Apache Wicket	Version 7.0.0 milestone5

Related CWEs

CWE-310

References (4)

http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E

Source: secalert@redhat.com

https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html

Source: secalert@redhat.com

Third Party Advisory

http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.