CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

Score

CVSS 3.0 8.8 High

Status

Modified - security@apache.org

Published

2017-10-03

Last modified

2024-09-16

Weaknesses

CWE-352

Affected products

• Wicket (Apache)
• Apache Wicket (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%…