CVE-2014-0043: Apache Wicket Classpath Disclosure Vulnerability
Summary
CVE-2014-0043: Apache Wicket allows attackers to check for third-party libraries. Affects org.apache.wicket:wicket-core across 2 version ranges.
>= 1.5-RC1, < 1.5.11
>= 6.0.0-beta1, < 6.14.0
Fixed in 1.5.11 or 6.14.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Wicket is a popular open-source web application framework for Java that simplifies the development of dynamic web applications. It provides a component-based architecture, allowing developers to create reusable UI components. However, certain versions of Wicket are vulnerable to a classpath disclosure issue, which can expose sensitive information about third-party libraries in use.
Vulnerability Detail
In Apache Wicket versions 1.5.10 and 6.13.0, attackers can exploit specific URLs handled by Wicket to check for the existence of particular classes in the classpath. This vulnerability allows them to ascertain whether a third-party library with known security vulnerabilities is present in the application. The potential ramifications include increased risk of exploitation of those vulnerabilities by malicious actors, leading to unauthorized access or data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.5-RC1, < 1.5.111.5.11 -
>= 6.0.0-beta1, < 6.14.06.14.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the vulnerable URLs by implementing security measures such as URL filtering or authentication checks to prevent unauthorized access.
Conclusion
The Apache Wicket classpath disclosure vulnerability (CVE-2014-0043) poses a risk to applications using affected versions of the framework. It is crucial for developers to update to the latest patched versions to mitigate this risk and protect their applications from potential exploitation.
See every vulnerability recorded for org.apache.wicket:wicket-core →
FAQ
Apache Wicket versions 1.5.10 and 6.13.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The vulnerability can lead to the exposure of sensitive information about third-party libraries, increasing the risk of exploitation by attackers.
Yes, the permanent fix is to update to the patched versions of Apache Wicket: 1.5.11 or 6.14.0.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.wicket:wicket-core.
