CVE-2014-3526

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-30 · updated 2026-06-17
Weakness: CWE-200

Description

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Affected products

Apache Software Foundation Apache Wicket: from 1.5.0 before 1.5.12; 6.0.0, 6.0.0-beta1, 6.0.0-beta2, 6.0.0-beta3, 6.1.0, 6.1.1 (+19) — fixed in 1.5.12

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Wicket 1.5.12. Check the vendor advisory for mitigations.

References

https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html
https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html

Get alerted when CVE-2014-3526 or the next vulnerability affects your stack