Description
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.wicket:wicket-core | < 1.5.12 | 1.5.12 | GHSA-q7wx-mhx4-jr8q |
| Maven | org.apache.wicket:wicket-core | >= 6.0, < 6.17.0 | 6.17.0 | GHSA-q7wx-mhx4-jr8q |
| Maven | org.apache.wicket:wicket-core | >= 7.0.0-M1, < 7.0.0-M3 | 7.0.0-M3 | GHSA-q7wx-mhx4-jr8q |