Read the docs
TI-2024-24295 Aliases CVE-2024-36522GHSA-hhwc-gh8h-9rrp

Apache Wicket: Remote code execution via XSLT injection

Priority MEDIUM 47CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02127 82nd percentileScored 2026-11-07
Fix Fixed org.apache.wicket:wicket-util (Maven): 10.1.0, 9.18.0, 8.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Wicket10.0.0-M1 – 10.0.0; 9.0.0 – 9.17.0; 8.0.0 – 8.15.0—No fix listedCNA
—org.apache.wicket:wicket-util (Maven)10.0.0-M1 to before 10.1.010.1.0Patch availableGHSA-hhwc-gh8h-9rrp
—org.apache.wicket:wicket-util (Maven)9.0.0 to before 9.18.09.18.0Patch availableGHSA-hhwc-gh8h-9rrp
—org.apache.wicket:wicket-util (Maven)8.0.0 to before 8.16.08.16.0Patch availableGHSA-hhwc-gh8h-9rrp
  • Apache Wicket VendorApache Affected 10.0.0-M1 – 10.0.0; 9.0.0 – 9.17.0; 8.0.0 – 8.15.0 Fixed in — No fix listed CNA
  • org.apache.wicket:wicket-util (Maven) Vendor— Affected 10.0.0-M1 to before 10.1.0 Fixed in 10.1.0 Patch available GHSA-hhwc-gh8h-9rrp
  • org.apache.wicket:wicket-util (Maven) Vendor— Affected 9.0.0 to before 9.18.0 Fixed in 9.18.0 Patch available GHSA-hhwc-gh8h-9rrp
  • org.apache.wicket:wicket-util (Maven) Vendor— Affected 8.0.0 to before 8.16.0 Fixed in 8.16.0 Patch available GHSA-hhwc-gh8h-9rrp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*8.0.0 to before 8.16.0; 9.0.0 to before 9.18.0VulnerableApache
cpe:2.3:a:apache:wicket:10.0.0:milestone1:*:*:*:*:*:*10.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:wicket:10.0.0:milestone2:*:*:*:*:*:*10.0.0 milestone2VulnerableApache
  • cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.16.0; 9.0.0 to before 9.18.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:wicket:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:wicket:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-hhwc-gh8h-9rrp org.apache.wicket:wicket-util (Maven) Fixed in 10.1.0 Advisory →
  • Fix · GHSA-hhwc-gh8h-9rrp org.apache.wicket:wicket-util (Maven) Fixed in 9.18.0 Advisory →
  • Fix · GHSA-hhwc-gh8h-9rrp org.apache.wicket:wicket-util (Maven) Fixed in 8.16.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-36522
  2. 2026-10-03 Alias added: GHSA-hhwc-gh8h-9rrp

References

Advisory 3

Other 1

  • TI-2016-05834 The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows… CVSS 3.0CRITICAL 9.1
  • TI-2026-28853 Apache Wicket: possible session fixation using AuthenticatedWebSession CVSS 3.1CRITICAL 9.1
  • TI-2026-49926 Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed CVSS 3.1HIGH 7.5
  • TI-2021-06275 DNS proxy and possible amplification attack CVSS 3.1HIGH 7.5
  • TI-2016-05847 Cross-site request forgery in Apache Wicket CVSS 3.0HIGH 8.8
  • TI-2026-31747 Apache Wicket: crafted URLs can bypass PackageResourceGuard CVSS 3.1HIGH 7.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences