CVE-2024-36522criticalCWE-74

CVE-2024-36522: fallo crítico en Apache Wicket

Apache Wicket: Remote code execution via XSLT injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Wicket+ Monitorear org.apache.wicket:wicket-util

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 2.1%
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache Wicket
CVEs relacionadas — Apache Wicket

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-23937—DNS proxy and possible amplification attackEPSS 4.3%CVE-2014-0043—CVE-2014-0043EPSS 3.0%CVE-2024-53299MEDIUMApache Wicket: An attacker can intentionally trigger a memory leakEPSS 1.5%CVE-2026-70449MEDIUMApache Wicket: Path traversal in resource style/variation/localeEPSS 0.9%CVE-2016-6806—CVE-2016-6806EPSS 0.8%CVE-2026-71257HIGHApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedEPSS 0.7%