CVE-2016-6806
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2016
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Apache Wicket
- Vendor
- Apache Software Foundation
- Product
- Apache Wicket
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.20.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 6.21.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 6.22.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 6.23.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 6.24.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.0.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.1.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.2.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.3.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.4.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.0.0-M1 | affected | Unavailable | Unavailable | Unavailable | None listed |