Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.wicket:wicket-core(Maven) | 0 | 1.5.13 | N/A |
| org.apache.wicket:wicket-core(Maven) | 6.0.0-beta1 | 6.19.0 | N/A |
| org.apache.wicket:wicket-core(Maven) | 7.0.0-M1 | 7.0.0-M5 | N/A |
CVSS Metrics
