CVE-2024-27439
published 2024-03-19CVE-2024-27439: An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.68%
48.1th percentile
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.
Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | wicket | — | — |
| apache | wicket | >= 9.1.0 < 9.17.0 | 9.17.0 |
| apache_software_foundation | apache_wicket | >= 10.0.0-M1 < 10.0.0 | 10.0.0 |
| apache_software_foundation | apache_wicket | 9.1.0 – 9.16.0 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-Site Request Forgery in Apache Wicket
osv·2024-03-19
CVE-2024-27439 [MEDIUM] Cross-Site Request Forgery in Apache Wicket
Cross-Site Request Forgery in Apache Wicket
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.
Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
GHSA
Cross-Site Request Forgery in Apache Wicket
ghsa·2024-03-19
CVE-2024-27439 [MEDIUM] CWE-352 Cross-Site Request Forgery in Apache Wicket
Cross-Site Request Forgery in Apache Wicket
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.
Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
Red Hat
apache-wicket: Possible bypass of CSRF protection
vendor_redhat·2024-03-19·CVSS 6.5
CVE-2024-27439 [MEDIUM] CWE-807 apache-wicket: Possible bypass of CSRF protection
apache-wicket: Possible bypass of CSRF protection
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.
Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
A flaw was found in Apache Wicket. Under certain circumstances, this flaw allows an attacker to bypass Cross-Site Request Forgery (CSRF) protections.
Package: org.jboss.windup-windup-parent (Migration Toolkit for Applications 6) - Will not fix
Package: org.jboss.windup-windup-parent (Migration Toolkit for Runtimes) - Not
No detection rules found.
No public exploits indexed.
2024-03-19
Published