Non notée
CVE-2021-23937 A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to…
Description
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Wicket 9.2 | premières → 9.2.0 | Pas de correctif indiqué |
| Apache Wicket 8.11 | premières → 8.11.0 | Pas de correctif indiqué |
| Apache Wicket 7.17 | premières → 7.17.0 | Pas de correctif indiqué |
| Apache Wicket 6.2 | 6.2.0 → dernières | Pas de correctif indiqué |
Autres CVE de Apache Wicket
Les 40 CVE de Apache Wicket →
CVE-2026-111089
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
7.6
Élevée
CVE-2026-95863
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
7.6
Élevée
CVE-2026-87718
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
2.3
Faible
CVE-2026-84231
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
7.4
Élevée