CVE-2021-23937
published 2021-05-25CVE-2021-23937: A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | wicket | 6.0.0 – 6.2.0 | — |
| apache | wicket | 7.0.0 – 7.17.0 | — |
| apache | wicket | 8.0.0 – 8.11.0 | — |
| apache | wicket | 9.0.0 – 9.2.0 | — |
| apache_software_foundation | apache_wicket | >= 6.2.0 < Apache Wicket 6.x* | Apache Wicket 6.x* |
| apache_software_foundation | apache_wicket | Apache Wicket 7.x – 7.17.0 | — |
| apache_software_foundation | apache_wicket | Apache Wicket 8.x – 8.11.0 | — |
| apache_software_foundation | apache_wicket | Apache Wicket 9.x – 9.2.0 | — |