CVE-2014-3526: Apache Wicket

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Affected products

• Apache Wicket: from 1.5.0, before 1.5.12 (fixed in 1.5.12); version 6.0.0 only; version 6.1.0 only; version 6.1.1 only; version 6.2.0 only; version 6.3.0 only; …

Published 2017-10-30. Last modified 2026-06-17.