CVE-2014-3526

Опубликовано: 30 окт. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Ссылки

https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html
Issue Tracking
Third Party Advisory
https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*

Версия от 1.5.0 (включая) до 1.5.12 (исключая)

cpe:2.3:a:apache:wicket:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.3.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.6.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.7.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.8.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.9.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.9.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.10.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.11.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.12.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.13.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.14.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.15.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:6.16.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:7.0.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:apache:wicket:7.0.0:milestone2:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00499

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-q7wx-mhx4-jr8q