CVE-2024-36522

2024-07-1213:15:11

CWE-74

apache

web.nvd.nist.gov

xslt injection

remote code execution

xsltresourcestream.java

untrusted source

update

cve-2024-36522

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

EPSS

Percentile

9.3%

JSON

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Affected configurations

Vulners

Vulnrichment

Node

apachewicketRange≤10.0.0

apachewicketRange≤9.17.0

apachewicketRange≤8.15.0

VendorProductVersionCPE
apachewicket*cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	wicket	*	cpe:2.3:a:apache:wicket::::::::

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.wicket:wicket-util",
    "product": "Apache Wicket",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "10.0.0",
        "status": "affected",
        "version": "10.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.17.0",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.15.0",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "semver"
      }
    ]
  }
]