What is GHSA-vfmm-jm4v-7frq?

GHSA-vfmm-jm4v-7frq is a security advisory published by GitHub Security Advisories with High severity. Apache Wicket insecure defaults

Which CVE IDs does GHSA-vfmm-jm4v-7frq cover?

GHSA-vfmm-jm4v-7frq covers the following CVE IDs: CVE-2014-7808. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vfmm-jm4v-7frq?

GHSA-vfmm-jm4v-7frq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vfmm-jm4v-7frq?

GHSA-vfmm-jm4v-7frq affects 3 products, including: maven/org.apache.wicket:wicket-core:\u003c 1.5.13; maven/org.apache.wicket:wicket-core:\u003e= 6.0.0-beta1, \u003c 6.19.0; maven/org.apache.wicket:wicket-core:\u003e= 7.0.0-M1, \u003c 7.0.0-M5.

GHSA-vfmm-jm4v-7frqHighCVSS 7.5

Apache Wicket insecure defaults

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 22, 2025

🔗 CVE IDs covered (1)

CVE-2014-7808 →

📋 Description

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

🎯 Affected products3

maven/org.apache.wicket:wicket-core:< 1.5.13
maven/org.apache.wicket:wicket-core:>= 6.0.0-beta1, < 6.19.0
maven/org.apache.wicket:wicket-core:>= 7.0.0-M1, < 7.0.0-M5

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2014-7808
https://github.com/apache/wicket/commit/d2b8848346b8f806e747dca18799d70c37fc893f
https://lists.apache.org/thread/rqy6lpo5mzco85cbf65r53vdh87gz77b
https://web.archive.org/web/20180830051017/https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html
https://github.com/advisories/GHSA-vfmm-jm4v-7frq