Threats tagged 'ghsa-5h36-fqxx-fjph'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 suffer from insufficient session expiration in its native WebSocket support. The issue arises because the WebSocket connection uses a copy of the HTTP session as it was at connection time, detaching from the live container session. As a result, when the container invalidates the session (e.g., logout or timeout), the WebSocket connection continues to operate with the old session state, potentially allowing authorization decisions against revoked identities. This affects applications using Wicket's native WebSocket on authenticated pages where sessions are ended by the container rather than Wicket. Some containers may close WebSocket connections on session destruction, but this behavior is container-specific. The issue is fixed in Apache Wicket versions 8.20.0, 9.25.0, and 10.12.0.