by Kastro
Paper/Archive/CVE-2024-36522

CVE-2024-36522

Apache Software Foundation Apache Wicket — Apache Wicket: Remote code execution via XSLT injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.9.819 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Affected

ProductAffectedFixed inSource
Apache Wicket10.0.0-M1 – 10.0.0–CNA
Apache Wicket9.0.0 – 9.17.0–CNA
Apache Wicket8.0.0 – 8.15.0–CNA
wicket10.0.0-m1 – 10.0.0–CISA-ADP
wicket8.0.0 – 8.15.0–CISA-ADP
wicket9.0.0 – 9.17.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorylists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkcrefopenwall.com/lists/oss-security/2024/07/12/2