CVE-2024-36522

published 2024-07-12

CVE-2024-36522: The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wicket	—	—
apache	wicket	>= 8.0.0 < 8.16.0	8.16.0
apache	wicket	>= 9.0.0 < 9.18.0	9.18.0
apache_software_foundation	apache_wicket	10.0.0-M1 – 10.0.0	—
apache_software_foundation	apache_wicket	8.0.0 – 8.15.0	—
apache_software_foundation	apache_wicket	9.0.0 – 9.17.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-74