CVE-2014-3526: Exposure of Sensitive Information to an Unauthorized Actor

May 13, 2022 (updated August 16, 2023)

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

References

github.com/advisories/GHSA-q7wx-mhx4-jr8q
nvd.nist.gov/vuln/detail/CVE-2014-3526
wicket.apache.org/news/2014/09/22/cve-2014-3526.html

Code Behaviors & Features

Detect and mitigate CVE-2014-3526 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →