Vulnerability in Apache Wicket Allowing Classpath Disclosure
CVE-2014-0043

5.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Wicket
Vendor
CVE Published:
3 October 2017

Badges

👾 Exploit Exists🟡 Public PoC

Summary

In specific versions of Apache Wicket, including 1.5.10 and 6.13.0, a vulnerability exists that allows attackers to issue requests to certain URLs. This capability can lead to the exposure of particular classes present in the application's classpath, enabling an attacker to determine the presence of third-party libraries that may contain known security issues. Mitigating this risk involves monitoring classpath access and ensuring that outdated libraries are updated.

Affected Version(s)

Apache Wicket 1.5.10

Apache Wicket 6.13.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

JavaClasspathEnum
Created by JJK96

References

https://lists.apache.org/thread.html/d95e962f2f059a09f5ab...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.