-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.wicket:wicket-core | maven | >= 9.0.0, < 9.3.0 | 9.3.0 |
| org.apache.wicket:wicket-core | maven | >= 8.0.0, < 8.12.0 | 8.12.0 |
| org.apache.wicket:wicket-core | maven | < 7.18.0 | 7.18.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the getRemoteAddr method's handling of X-Forwarded-For headers. The pre-patch code: 1) Extracted X-Forwarded-For header values, 2) Attempted to resolve them via InetAddress.getByName(), 3) Lacked proper validation of input format. The commit diff shows removal of all X-Forwarded-For processing logic, replacing it with direct use of getRemoteAddr(). The CWE-20 (Input Validation) classification confirms this was an unsanitized input handling issue. The DNS lookup pattern (InetAddress.getByName()) on untrusted header data directly enables the described amplification/DoS scenario.
JavaJavaOngoing coverage of React2Shell