Threats tagged 'ghsa-vprr-p32v-2q45'

Apache Wicket versions 10.3.0 through 10.11.0 contain a missing authorization vulnerability in form submission handling. The framework fails to verify that the form submitting component is visible and enabled, allowing unauthorized invocation of submit buttons that should be inaccessible. This bypass affects components hidden or disabled by various means, including visibility flags and authorization strategies. Ajax-based form submissions are not affected. The issue was introduced in version 10.3.0 and fixed in 10.12.0.