CVE-2024-36522
1 advisory.
Maven/org.apache.wicket:wicket-util CVE-2024-36522: high
Apache Wicket: Remote code execution via XSLT injection
Action: Upgrade org.apache.wicket:wicket-util to 8.16.0 (8.x), 9.18.0 (9.x) or 10.1.0 (10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0-M1 | 10.1.0 | - |
| 9.0.0 | 9.18.0 | - |
| 8.0.0 | 8.16.0 | - |
Fixed versions
| 10.1.0 | 9.18.0 | 8.16.0 |
Sources
- osv: GHSA-hhwc-gh8h-9rrp
- https://nvd.nist.gov/vuln/detail/CVE-2024-36522
- https://github.com/apache/wicket
- https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkc
- http://www.openwall.com/lists/oss-security/2024/07/12/2
CVE-2024-36522 · published · modified · JSON