What is CVE-2016-6806?

CVE-2016-6806 is a high-severity vulnerability in Apache Wicket, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-10-03.

How severe is CVE-2016-6806?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Apache Wicket

CVE-2016-6806

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.008 (54.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Apache Wicket — versions 6.20.0, 6.21.0, 6.22.0
Apache Software Foundation Wicket — versions 8.0.0-M1, 7.1.0, 6.21.0

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security@apache.org (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2016-6806?: CVE-2016-6806 is a high-severity vulnerability in Apache Wicket, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-10-03.
How severe is CVE-2016-6806?: High severity. CVSS v3 base score is 8.8 out of 10.