Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveApacheCVE-2021-23937
HistoryMay 25, 2021 - 5:15 p.m.

CVE-2021-23937

2021-05-2517:15:08
CWE-200
apache
web.nvd.nist.gov
45
2
apache wicket
vulnerability
dns proxy
denial of service
cve-2021-23937
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

51.8%

JSON

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.

Affected configurations

Nvd
Vulners
Node
apachewicketRange6.0.0–6.2.0
OR
apachewicketRange7.0.0–7.17.0
OR
apachewicketRange8.0.0–8.11.0
OR
apachewicketRange9.0.0–9.2.0
VendorProductVersionCPE
apachewicket*cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Apache Wicket",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "9.2.0",
        "status": "affected",
        "version": "Apache Wicket 9.x",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "8.11.0",
        "status": "affected",
        "version": "Apache Wicket 8.x",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "7.17.0",
        "status": "affected",
        "version": "Apache Wicket 7.x",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache Wicket 6.x*",
        "status": "affected",
        "version": "6.2.0",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

Related

osv 2
cvelist 1
github 1
nvd 1
prion 1
osv
osv
CVE-2021-23937
2021-05-25 17:15:08
DNS based denial of service in Apache Wicket
2022-05-24 19:03:11
cvelist
cvelist
CVE-2021-23937 DNS proxy and possible amplification attack
2021-05-25 08:05:10
github
github
DNS based denial of service in Apache Wicket
2022-05-24 19:03:11
nvd
nvd
CVE-2021-23937
2021-05-25 17:15:08
prion
prion
Design/Logic Flaw
2021-05-25 17:15:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

51.8%

JSON
Related for CVE-2021-23937
osv2cvelist1github1nvd1prion1