Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.wicket:wicket-core(Maven) | 0 | 1.5.12 | N/A |
| org.apache.wicket:wicket-core(Maven) | 6.0 | 6.17.0 | N/A |
| org.apache.wicket:wicket-core(Maven) | 7.0.0-M1 | 7.0.0-M3 | N/A |
CVSS Metrics
