What is the CVSS score of CVE-2013-2055?

CVE-2013-2055 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 1.6%.

Wicket CVE-2013-2055

MEDIUM

2014-02-10 secalert@redhat.com

Apache Information Disclosure Wicket

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Feb 10, 2014 - 23:55 cve.org

MEDIUM 5.0

DescriptionCVE.org

Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup.

AnalysisAI

Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wicket

View all

CVE-2015-5347 MEDIUM This Month POC

6.1 Apr 12

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.ma

CVE-2016-6793 CRITICAL Act Now

9.1 Jul 17

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den

CVE-2024-36522 CRITICAL Act Now

9.8 Jul 12

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when proc

CVE-2016-6806 HIGH This Week

8.8 Oct 03

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover

CVE-2014-3526 HIGH This Week

7.5 Oct 30

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive

CVE-2014-7808 HIGH This Week

7.5 Sep 15

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptog

CVE-2021-23937 HIGH This Week

7.5 May 25

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trig

CVE-2020-11976 HIGH This Week

7.5 Aug 11

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.

CVE-2024-27439 MEDIUM This Month

6.5 Mar 19

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.

CVE-2012-5636 MEDIUM This Month

6.1 Oct 30

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0

CVE-2015-7520 MEDIUM This Month

6.1 Apr 12

Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apac

CVE-2014-0043 MEDIUM This Month

5.3 Oct 03

In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for th

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2013-2055 vulnerability details – vuln.today

Back