Unscored severity · published Feb 10, 2014
CVE-2013-2055
Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that…
–
CVSS
3.2%
EPSS
No
On KEV
Description
Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wicket · Apache
1.4.0; 1.4.1; 1.4.10; 1.4.11; 1.4.12; 1.4.13; +29 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2055
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2055
osvdb.org
http://osvdb.org/102955
seclists.org
http://seclists.org/fulldisclosure/2014/Feb/38
www.securityfocus.com
http://www.securityfocus.com/bid/65431
Vendor Advisory
https://wicket.apache.org/2013/05/17/wicket-6.8.0-released.html
Vendor Advisory
https://wicket.apache.org/2014/02/06/cve-2013-2055.html
More from Wicket
9.8
CVE-2024-36522
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation
9.1
CVE-2026-40010
Apache Wicket: possible session fixation using AuthenticatedWebSession
9.1
CVE-2016-6793
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and…
8.8
CVE-2016-6806
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests
7.5
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed