{"action":"Upgrade org.apache.wicket:wicket-util to 8.16.0 (8.x), 9.18.0 (9.x) or 10.1.0 (10.x) or later.","affected":[{"fixed":"10.1.0","introduced":"10.0.0-M1"},{"fixed":"9.18.0","introduced":"9.0.0"},{"fixed":"8.16.0","introduced":"8.0.0"}],"component":"org.apache.wicket:wicket-util","cve_ids":["CVE-2024-36522"],"ecosystem":"Maven","epss":0.02127,"exploited":false,"fixed_versions":["10.1.0","9.18.0","8.16.0"],"ghsa_id":"GHSA-hhwc-gh8h-9rrp","id":"tcs_01M5N90SW6EVYQ374AQY3WW9PR","modified_at":"2024-12-07T05:32:44.574798Z","published_at":"2024-07-12T15:31:26Z","references":["https://osv.dev/vulnerability/GHSA-hhwc-gh8h-9rrp","https://nvd.nist.gov/vuln/detail/CVE-2024-36522","https://github.com/apache/wicket","https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkc","http://www.openwall.com/lists/oss-security/2024/07/12/2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-hhwc-gh8h-9rrp","url":"https://osv.dev/vulnerability/GHSA-hhwc-gh8h-9rrp"}],"summary":"Apache Wicket: Remote code execution via XSLT injection"}