Threats tagged 'ghsa-4f8f-rp3w-cwx9'

Apache Wicket versions 9.1.0 through 9.24.0 and 10.0.0 through 10.11.0 have an incorrect order of security checks in the ResourceIsolationRequestCycleListener. This flaw allows a request from another origin to bypass resource isolation policies due to an exception thrown before policy checks run. The issue arises when unauthorized access is refused using RestartResponseAtInterceptPageException, which stores the original URL including query parameters. After signing in, Wicket redirects to this URL, potentially resuming a form submission with values controlled by another origin. Versions before 9.1.0 are not affected. Users are advised to upgrade to versions 9.25.0 or 10.12.0 where the issue is fixed.