Read the docs
TI-2014-00041 Aliases CVE-2014-0043GHSA-244g-8368-6wr9

Information disclosure in Apache Wicket

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.

Why it matters now

EPSS 0.03012 87th percentileScored 2026-11-07
Fix Fixed org.apache.wicket:wicket-core (Maven): 1.5.11, 6.14.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Wicket1.5.10; 6.13.0—No fix listedCNA
—org.apache.wicket:wicket-core (Maven)1.5-RC1 to before 1.5.111.5.11Patch availableGHSA-244g-8368-6wr9
—org.apache.wicket:wicket-core (Maven)6.0.0-beta1 to before 6.14.06.14.0Patch availableGHSA-244g-8368-6wr9
  • Apache Wicket VendorApache Affected 1.5.10; 6.13.0 Fixed in — No fix listed CNA
  • org.apache.wicket:wicket-core (Maven) Vendor— Affected 1.5-RC1 to before 1.5.11 Fixed in 1.5.11 Patch available GHSA-244g-8368-6wr9
  • org.apache.wicket:wicket-core (Maven) Vendor— Affected 6.0.0-beta1 to before 6.14.0 Fixed in 6.14.0 Patch available GHSA-244g-8368-6wr9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:wicket:1.5.10:*:*:*:*:*:*:*1.5.10VulnerableApache
cpe:2.3:a:apache:wicket:6.13.0:*:*:*:*:*:*:*6.13.0VulnerableApache
  • cpe:2.3:a:apache:wicket:1.5.10:*:*:*:*:*:*:* Versions 1.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:wicket:6.13.0:*:*:*:*:*:*:* Versions 6.13.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-244g-8368-6wr9 org.apache.wicket:wicket-core (Maven) Fixed in 1.5.11 Advisory →
  • Fix · GHSA-244g-8368-6wr9 org.apache.wicket:wicket-core (Maven) Fixed in 6.14.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0043
  2. 2026-10-03 Alias added: GHSA-244g-8368-6wr9

References

Advisory 1

Other 3

  • TI-2016-05834 The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows… CVSS 3.0CRITICAL 9.1
  • TI-2026-28853 Apache Wicket: possible session fixation using AuthenticatedWebSession CVSS 3.1CRITICAL 9.1
  • TI-2024-24295 Apache Wicket: Remote code execution via XSLT injection CVSS 3.1CRITICAL 9.8
  • TI-2026-49926 Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed CVSS 3.1HIGH 7.5
  • TI-2021-06275 DNS proxy and possible amplification attack CVSS 3.1HIGH 7.5
  • TI-2016-05847 Cross-site request forgery in Apache Wicket CVSS 3.0HIGH 8.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences