Threats tagged 'ghsa-c8q4-2mh6-cqxp'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 have a missing authorization enforcement issue. The framework's authorization strategy is bypassed when resources are served through certain components using IResource instances instead of ResourceReference, allowing unauthorized access to restricted resources. This affects applications that restrict resources via IAuthorizationStrategy or @AuthorizeResource annotations but use components that serve resources directly without the authorization check. The issue is fixed in versions 8.20.0, 9.25.0, and 10.12.0.