CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests

published October 2, 2017

CVSS
—
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00822 · 56.6th percentile
Published
2017-10-02T13:00Z
EPSS history
Timeline
  • 02 OCT 13:00Z
    Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests
    cvelistv5