CVE-2024-36522

published 2024-07-12

CVE-2024-36522: The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wicket	—	—
apache	wicket	>= 8.0.0 < 8.16.0	8.16.0
apache	wicket	>= 9.0.0 < 9.18.0	9.18.0
apache_software_foundation	apache_wicket	10.0.0-M1 – 10.0.0	—
apache_software_foundation	apache_wicket	8.0.0 – 8.15.0	—
apache_software_foundation	apache_wicket	9.0.0 – 9.17.0	—

CWE-74