com.github.jennybrown8.wicket-source:wicket-source (8.0.0), com.github.jennybrown8.wicket-source:wicket-source-demo (8.0.0) +258 more potentially affected by CVE-2016-6806 via org.apache.wicket:wicket-core (8.0.0-m1)

org.apache.wicket:wicket-core MAVEN version 8.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.github.jennybrown8.wicket-source:wicket-source 8.0.0 -...

CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

be.selckin.swu:swu (>=4.0, <=4.2), be.selckin.swu:swu-base (>=4.0, <=4.2) +473 more potentially affected by CVE-2016-6806 via org.apache.wicket:wicket-core (>=7.0.0, <=7.4.0)

org.apache.wicket:wicket-core MAVEN version =7.0.0, =4.0, =4.0, =4.0, =4.0, =4.0.0, =7.0.0.0, =7.0.0.0, =0.0.2, =0.0.1, =0.0.2, =0.7.1, =0.7.1, =0.7.1, =2.0.0, =7.0.0, =7.4.0 and more Source cves: CVE-2016-6806 Source advisory: MEND:CVE-2016-6806...

CVE-2016-6806

CVE-2016-6806 affects Apache Wicket 6.x prior to 6.25.0, 7.x prior to 7.5.0, and 8.0.0-M1, where CSRF protection could miss some cross-origin requests because only the Origin header was checked. The mitigation is to also validate the Referer header when Origin is absent and ensure all server-side...

CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...