CVE-2014-7808

Published: Sep 15, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

Affected (7)

Products: Apache: Wicket

Apache

1 product

Wicket

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Apache Wicket	From 1.5.0 to 1.5.13
Apache Wicket	From 6.0.0 to 6.19.0
Apache Wicket	Version 7.0.0 milestone1
Apache Wicket	Version 7.0.0 milestone2
Apache Wicket	Version 7.0.0 milestone3
Apache Wicket	Version 7.0.0 milestone4
Apache Wicket	Version 7.0.0 milestone5

Related CWEs

CWE-310

References (4)

http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E

Source: secalert@redhat.com

https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html

Source: secalert@redhat.com

Third Party Advisory

http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.