Test Kennung:	1.3.6.1.4.1.25623.1.0.811841
Kategorie:	General
Titel:	Apache Wicket 'CryptoMapper' Cross Site Request Forgery Vulnerability
Zusammenfassung:	Apache Wicket is prone to a cross-site request forgery (CSRF) vulnerability.
Beschreibung:	Summary: Apache Wicket is prone to a cross-site request forgery (CSRF) vulnerability. Vulnerability Insight: The flaw is due to Wicket's default security settings of the usage of CryptoMapper to encrypt/obfuscate pages urls, which is not strong enough. It is possible to predict the encrypted version of an url based on the previous history. Vulnerability Impact: Successful exploitation will allow attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider. Affected Software/OS: Apache Wicket versions before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5. Solution: Upgrade to Apache Wicket 1.5.13 or 6.19.0 or 7.0.0-M5 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Querverweis:	BugTraq ID: 100946 Common Vulnerability Exposure (CVE) ID: CVE-2014-7808 https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw@mail.gmail.com%3E
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.