CVE-2016-6806 json
Apache Wicket vulnerable to CSRF attacks
published 2017-10-02 9 y ago modified 2026-06-17 4 mo ago also GHSA-xc66-mg8r-q6r5 , EUVD-2016-7700
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.
Patch / fix
- maven org.apache.wicket:wicket-core 6.25.0, 7.5.0, 8.0.0-M2
Exploit prediction
0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.wicket:wicket-core | >=6.20.0, <6.25.0 >=7.0.0, <7.5.0 >=8.0.0-M1, <8.0.0-M2 |
6.25.0 7.5.0 8.0.0-M2 |
Affected products
- Apache Software Foundation Apache Wicket
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
lists.apache.org
/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2016-6806
advisory
-
github.com
/apache/wicket
package
-
lists.apache.org
/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd@%3Cannounce.apache.org%3E
web
Sources
- CVE List CVE-2016-6806
- GitHub Advisory GHSA-xc66-mg8r-q6r5
- NVD CVE-2016-6806
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.