GitHub Advisoryadvisory · Maven

GHSA-8vvp-525h-cxf9 Cross-Site Request Forgery in Apache Wicket

MEDIUM Published 2024-03-19 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-27439
Ecosystem
Maven
Packages
org.apache.wicket:wicket
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-352
Reviewed
2024-03-20

Affected packages

• Maven org.apache.wicket:wicket: >= 9.1.0, < 9.17.0 → fixed in 9.17.0 • Maven org.apache.wicket:wicket: >= 10.0.0-M1, < 10.0.0 → fixed in 10.0.0

Description

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected. Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-27439 An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References