CVE-2014-7808
HighSummary
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
Risk Assessment
Organizations may be exposed to attacks that allow the prediction of encrypted data, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to upgrade Apache Wicket to the latest version to mitigate this vulnerability and consider using alternative encryption providers.
Other vulnerabilities in Apache Wicket
See all- CVE-2026-43646High
Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.
- CVE-2014-3526High
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via identifiers for storing page markup for temporary user sessions.
- CVE-2016-6806High
Apache Wicket versions 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 contain a security vulnerability that improperly handles CSRF prevention, failing to detect some cross-origin requests. The issue also involves not checking all Wicket server-side targets.
- CVE-2016-6793Critical
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
- CVE-2026-66391Medium
A vulnerability in Apache Wicket due to use of insufficiently random values and protection mechanism failure. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.
- CVE-2026-66390Medium
A Cross-Site Scripting (XSS) vulnerability in Apache Wicket due to improper input neutralization during web page generation. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.
Original NVD description (English source)
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.