CVE-2016-6793
CriticalSummary
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
Risk Assessment
This vulnerability can lead to serious availability issues and allow attackers to gain unauthorized access to files and execute malicious code, posing a threat to data integrity and confidentiality.
Recommendation
It is recommended to update Apache Wicket to version 6.25.0 or 1.5.17 and to monitor systems for suspicious activity related to files and executable code.
Original NVD description (English source)
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.