CVE-2016-6793

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/12/31/1Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/539975/100/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95168Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037541Third Party Advisory, VDB Entry
https://wicket.apache.org/news/2016/12/31/cve-2016-6793.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2016-23Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/31/1Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/539975/100/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95168Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037541Third Party Advisory, VDB Entry
https://wicket.apache.org/news/2016/12/31/cve-2016-6793.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2016-23Third Party Advisory

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-67945.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In CVE-2016-67959.8In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be CVE-2016-67967.5A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to CVE-2016-67977.5The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 CVE-2016-67989.8In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the inp CVE-2016-67997.5Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v()CVE-2016-68006.1The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are rel CVE-2016-68018.8Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6,CVE-2016-68027.5Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet contex CVE-2016-68037.8An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Wind CVE-2016-68047.8The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operati CVE-2016-68055.9Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.