CVE-2016-6793
Critical
Description
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Apache Wicket
PublishedJul 17, 2017
First seenJul 17, 2017
How to fix
Update
- apache wicket1.5.17, 6.25.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wicket | 1.5.0 ≤ v < 1.5.17, 6.0.0 ≤ v < 6.25.0 | 1.5.17, 6.25.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.