← Voltar para CVEs

CVE-2024-36522

CRITICAL

9.8

Descricao

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado7/12/2024

Ultima modificacao7/10/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:wicket

Fraquezas (CWE)

CWE-74

Referencias

http://www.openwall.com/lists/oss-security/2024/07/12/2(security@apache.org)

https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkc(security@apache.org)

http://www.openwall.com/lists/oss-security/2024/07/12/2(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkc(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.