CVE-2024-27439

CVSS V2 None CVSS V3 None
Description
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected. Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
Overview
  • CVE ID
  • CVE-2024-27439
  • Assigner
  • apache
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-03-19T11:07:47.648Z
  • Last Modified Date
  • 2024-03-19T11:07:47.648Z
Weakness Enumerations
CWE URL
CWE-352 http://cwe.mitre.org/data/definitions/352.html
CWE-444 http://cwe.mitre.org/data/definitions/444.html
References
Reference URL Reference Tags
https://lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1lo vendor-advisory
http://www.openwall.com/lists/oss-security/2024/03/19/2
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-27439
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27439
History
Created Old Value New Value Data Type Notes
2024-06-26 01:46:05 Added to TrackCVE