CVE-2024-36522criticalCWE-74

CVE-2024-36522: falha crítica em Apache Wicket

Apache Wicket: Remote code execution via XSLT injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Wicket+ Monitorar org.apache.wicket:wicket-util

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 2.1%
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache Wicket
CVEs relacionadas — Apache Wicket

No mesmo produto, das mais perigosas para as menos.

CVE-2021-23937—DNS proxy and possible amplification attackEPSS 4.3%CVE-2014-0043—CVE-2014-0043EPSS 3.0%CVE-2024-53299MEDIUMApache Wicket: An attacker can intentionally trigger a memory leakEPSS 1.5%CVE-2026-70449MEDIUMApache Wicket: Path traversal in resource style/variation/localeEPSS 0.9%CVE-2016-6806—CVE-2016-6806EPSS 0.8%CVE-2026-71257HIGHApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedEPSS 0.7%