CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-36522
Critical (9.8) in apache wicket. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in org.apache.wicket:wicket-util 10.1.0, 8.16.0, 9.18.0.
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:wicket
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hhwc-gh8h-9rrp | Maven | org.apache.wicket:wicket-util | >=10.0.0-M1 <10.1.0 | 10.1.0 |
| GHSA-hhwc-gh8h-9rrp | Maven | org.apache.wicket:wicket-util | >=9.0.0 <9.18.0 | 9.18.0 |
| GHSA-hhwc-gh8h-9rrp | Maven | org.apache.wicket:wicket-util | >=8.0.0 <8.16.0 | 8.16.0 |