Publish Advisories

GHSA-244g-8368-6wr9 GHSA-244g-8368-6wr9
2026-05-22 18:04:22 -07:00 · 2025-04-23 02:21:15 +00:00
parent 43dff60c9c
commit dab81aa3cd
2 changed files with 86 additions and 40 deletions
@@ -0,0 +1,86 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-244g-8368-6wr9",
+  "modified": "2025-04-23T02:20:00Z",
+  "published": "2022-05-17T00:33:50Z",
+  "aliases": [
+    "CVE-2014-0043"
+  ],
+  "summary": "Apache Wicket allows attackers to check for third-party libraries",
+  "details": "In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.wicket:wicket-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.5-RC1"
+            },
+            {
+              "fixed": "1.5.11"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.5.10"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.wicket:wicket-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.0.0-beta1"
+            },
+            {
+              "fixed": "6.14.0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 6.13.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0043"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/wicket"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d@1392986987@%3Cannounce.wicket.apache.org%3E"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-23T02:20:00Z",
+    "nvd_published_at": "2017-10-03T01:29:00Z"
+  }
+}
@@ -1,40 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-244g-8368-6wr9",
-  "modified": "2025-04-20T03:46:07Z",
-  "published": "2022-05-17T00:33:50Z",
-  "aliases": [
-    "CVE-2014-0043"
-  ],
-  "details": "In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0043"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d%401392986987%40%3Cannounce.wicket.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d@1392986987@%3Cannounce.wicket.apache.org%3E"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-200"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2017-10-03T01:29:00Z"
-  }
-}