deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-86wq-234q-r6wg
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 3.1.0, <= 3.1.13
Patched in: unpatched

Summary: Spring Cloud Config Server Susceptible To TOCTOU Attack

Details:
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-6g23-24mc-hx6x
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 5.0.0, <= 5.0.2
Patched in: 5.0.3

Summary: Spring Cloud Config vulnerable to Path Traversal

Details:
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-6g23-24mc-hx6x
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.3.0, <= 4.3.2
Patched in: 4.3.3

Summary: Spring Cloud Config vulnerable to Path Traversal

Details:
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-6g23-24mc-hx6x
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0, <= 4.2.6
Patched in: unpatched

Summary: Spring Cloud Config vulnerable to Path Traversal

Details:
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-6g23-24mc-hx6x
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.1.0, <= 4.1.9
Patched in: unpatched

Summary: Spring Cloud Config vulnerable to Path Traversal

Details:
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-6g23-24mc-hx6x
Package: org.springframework.cloud:spring-cloud-config-server (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.1.0, <= 3.1.13
Patched in: unpatched

Summary: Spring Cloud Config vulnerable to Path Traversal

Details:
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-2mh5-3cw6-hrrq
Package: org.springframework.cloud:spring-cloud-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 5.0.0, <= 5.0.2
Patched in: 5.0.3

Summary: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key 

Details:
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-2mh5-3cw6-hrrq
Package: org.springframework.cloud:spring-cloud-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 4.3.0, <= 4.3.2
Patched in: 4.3.3

Summary: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key 

Details:
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-2mh5-3cw6-hrrq
Package: org.springframework.cloud:spring-cloud-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 4.2.0, <= 4.2.6
Patched in: unpatched

Summary: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key 

Details:
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-2mh5-3cw6-hrrq
Package: org.springframework.cloud:spring-cloud-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 4.1.0, <= 4.1.9
Patched in: unpatched

Summary: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key 

Details:
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-2mh5-3cw6-hrrq
Package: org.springframework.cloud:spring-cloud-config (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 3.1.0, <= 3.1.13
Patched in: unpatched

Summary: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key 

Details:
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
GitHub Security Advisory: GHSA-3jh5-rr2q-xfv7
Package: com.ritense.valtimo:web (MAVEN)
Severity: HIGH (CVSS 7.6)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 13.0.0, < 13.26.0
Patched in: 13.26.0

Summary: Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

Details:
### Summary

The `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring's `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.

### Impact

The logged data can contain highly sensitive information including:
- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
- Personal data (BSN, email addresses, case details) in request/response bodies
- Session tokens in `Set-Cookie` response headers

This data is exposed to:
- Anyone with access to application logs (stdout/log files)
- Users with access to logging aggregation tools (e.g. Grafana/Loki)
- Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)

Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.

Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)

### Affected Code

`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.

### Patched Versions

The vulnerability is fixed in:
- **12.33.0** (v12 release line) — see PR #600
- **13.26.0** (v13 release line) — see PR #599

The fix removes the request/response report, headers, and response body from the `HttpClientErrorException` constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).

### Mitigation

If you cannot upgrade to a patched version immediately, consider:
- Restricting access to application logs and the Valtimo logging module
- Adjusting the log level for `com.ritense.valtimo.web.logging` to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)
GitHub Security Advisory: GHSA-3jh5-rr2q-xfv7
Package: com.ritense.valtimo:web (MAVEN)
Severity: HIGH (CVSS 7.6)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 12.4.0, < 12.33.0
Patched in: 12.33.0

Summary: Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

Details:
### Summary

The `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring's `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.

### Impact

The logged data can contain highly sensitive information including:
- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
- Personal data (BSN, email addresses, case details) in request/response bodies
- Session tokens in `Set-Cookie` response headers

This data is exposed to:
- Anyone with access to application logs (stdout/log files)
- Users with access to logging aggregation tools (e.g. Grafana/Loki)
- Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)

Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.

Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)

### Affected Code

`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.

### Patched Versions

The vulnerability is fixed in:
- **12.33.0** (v12 release line) — see PR #600
- **13.26.0** (v13 release line) — see PR #599

The fix removes the request/response report, headers, and response body from the `HttpClientErrorException` constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).

### Mitigation

If you cannot upgrade to a patched version immediately, consider:
- Restricting access to application logs and the Valtimo logging module
- Adjusting the log level for `com.ritense.valtimo.web.logging` to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)
GitHub Security Advisory: GHSA-qpjw-p3jg-59j6
Package: org.apache.wicket:wicket-auth-roles (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 10.0.0-M1, <= 10.8.0
Patched in: 10.9.0

Summary: Apache Wicket has a Session Fixation issue

Details:
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-qpjw-p3jg-59j6
Package: org.apache.wicket:wicket-auth-roles (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 9.0.0-M1, <= 9.22.0
Patched in: unpatched

Summary: Apache Wicket has a Session Fixation issue

Details:
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-qpjw-p3jg-59j6
Package: org.apache.wicket:wicket-auth-roles (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 8.0.0-M1, <= 8.17.0
Patched in: unpatched

Summary: Apache Wicket has a Session Fixation issue

Details:
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-5x9h-93gp-chpj
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 10.0.0-M1, <= 10.8.0
Patched in: 10.9.0

Summary: Apache Wicket has a Cross-site Scripting issue

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-5x9h-93gp-chpj
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0-M1, <= 9.22.0
Patched in: unpatched

Summary: Apache Wicket has a Cross-site Scripting issue

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-5x9h-93gp-chpj
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0.0-M1, <= 8.17.0
Patched in: unpatched

Summary: Apache Wicket has a Cross-site Scripting issue

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-jvv4-8wxx-m5r6
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 10.0.0-M1, <= 10.8.0
Patched in: 10.9.0

Summary: Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Details:
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-jvv4-8wxx-m5r6
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 9.0.0-M1, <= 9.22.0
Patched in: unpatched

Summary: Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Details:
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
GitHub Security Advisory: GHSA-jvv4-8wxx-m5r6
Package: org.apache.wicket:wicket-parent (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 8.0.0-M1, <= 8.17.0
Patched in: unpatched

Summary: Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Details:
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.