Lucene search

GitHub Advisory DatabaseGHSA-8VVP-525H-CXF9

HistoryMar 19, 2024 - 12:30 p.m.

Cross-Site Request Forgery in Apache Wicket

2024-03-1912:30:40

CWE-352

GitHub Advisory Database

github.com

cross-site request forgery

apache wicket

csrf protection

security patch

upgrade

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

Affected configurations

Vulners

Node

org.apache.wicketwicketRange10.0.0-M1–10.0.0

org.apache.wicketwicketRange9.1.0–9.17.0

VendorProductVersionCPE
org.apache.wicketwicket*cpe:2.3:a:org.apache.wicket:wicket:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.wicket	wicket	*	cpe:2.3:a:org.apache.wicket:wicket::::::::

References

www.openwall.com/lists/oss-security/2024/03/19/2

github.com/advisories/GHSA-8vvp-525h-cxf9

lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1lo

nvd.nist.gov/vuln/detail/CVE-2024-27439