-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.wicket:wicket-core | maven | < 1.5.12 | 1.5.12 |
| org.apache.wicket:wicket-core | maven | >= 6.0, < 6.17.0 | 6.17.0 |
| org.apache.wicket:wicket-core | maven | >= 7.0.0-M1, < 7.0.0-M3 | 7.0.0-M3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Wicket generates storage keys for page markup using sessionId + URL. In temporary sessions (sessionId=null), the key becomes URL-only, causing collisions. The critical functions are those responsible for creating these keys (IPageStore.addPage) and handling redirects that trigger storage (RequestCycle.redirectToRenderPage). These functions would appear in runtime traces during exploitation as they process the insecure key generation. Confidence is medium due to reliance on advisory descriptions without explicit patch code, but the described mechanism strongly implicates these components.