Riskcovery

CVE-2016-6806

State
Published
Severity
Not scored
Published
Oct 2, 2017
Updated
Sep 16, 2024
Reserved
Aug 12, 2016

Read the record on cve.org

Description

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Apache WicketApache Software Foundation
  • 6.20.0Affected
  • 6.21.0Affected
  • 6.22.0Affected
  • 6.23.0Affected
  • 6.24.0Affected
  • 7.0.0Affected
  • 7.1.0Affected
  • 7.2.0Affected
  • 7.3.0Affected
  • 7.4.0Affected
  • 8.0.0-M1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.