full-disclosure - [CVE-2013-2055] Apache Wicket information disclosure vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 6 Feb 2014 10:39:20 +0100
From: Martin Grigorov <mgrigorov@...che.org>
To: announce@...ket.apache.org, 
 "users@...ket.apache.org" <users@...ket.apache.org>,
 "dev@...ket.apache.org" <dev@...ket.apache.org>
Cc: full-disclosure@...ts.grok.org.uk,
 "security@...che.org" <security@...che.org>, bugtraq@...urityfocus.com
Subject: [CVE-2013-2055] Apache Wicket information
	disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Affected versions:
Apache Wicket 1.4.22, 1.5.10 and 6.7.0

Description CVE-2013-2055<https://wicket.apache.org/2014/02/06/cve-2013-2055.html>
:

It is possible to make Wicket deliver the HTML templates in their
raw/non-processed form.
An attacker could see any sensitive information in the part of the HTML
template that is usually ignored during rendering.
For example if there is sensitive information before or after the Wicket
Panel/Border's markup:

[something sensitive here 1]
<wicket:panel>
   [real application code]
</wicket:panel>
[something sensitive here 2]

Usually Wicket will render only the [real application code] part but by
exploiting this vulnerability an attacker can see also the code with the
sensitive information.

The application developers are recommended to upgrade to:
- Apache Wicket
1.4.23<https://wicket.apache.org/2014/02/06/wicket-1.4.23-released.html>
- Apache Wicket
1.5.11<https://wicket.apache.org/2014/02/06/wicket-1.5.11-released.html>
- Apache Wicket
6.8.0<https://wicket.apache.org/2013/05/17/wicket-6.8.0-released.html>

and/or to remove any sensitive information in the HTML templates.

Apache Wicket Team

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/