4 results · Clear filters · Feed
-
Low 2.3
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a req…
-
Low 2.1
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obta…
-
Low 2.3
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connectio…
-
Low 2.3
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the cl…