GitHub Advisoryadvisory · Maven

GHSA-hhwc-gh8h-9rrp Apache Wicket: Remote code execution via XSLT injection

HIGH Published 2024-07-12 Modified 2024-07-18 Official page ↗
Aliases
CVE-2024-36522
Ecosystem
Maven
Packages
org.apache.wicket:wicket-util
Severity
High
Weaknesses
CWE-74
Reviewed
2024-07-12

Affected packages

• Maven org.apache.wicket:wicket-util: >= 10.0.0-M1, < 10.1.0 → fixed in 10.1.0 • Maven org.apache.wicket:wicket-util: >= 9.0.0, < 9.18.0 → fixed in 9.18.0 • Maven org.apache.wicket:wicket-util: >= 8.0.0, < 8.16.0 → fixed in 8.16.0

Description

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2024-36522 The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References