CVE-2024-27439

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-27439
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27439.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-27439
Aliases
Published
2024-03-19T11:07:47.648Z
Modified
2026-07-15T02:11:23.016330691Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Apache Wicket: Possible bypass of CSRF protection
Details

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-352",
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27439.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.1.0"
                },
                {
                    "last_affected": "9.16.0"
                },
                {
                    "introduced": "10.0.0-M1"
                },
                {
                    "fixed": "10.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "9.1.0"
                },
                {
                    "fixed": "9.16.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/wicket

Affected ranges

Type
GIT
Repo
https://github.com/apache/wicket
Events
Introduced
661e7797b8f361debc83984c58cc21be98fedf8b
Fixed
31760ab2980c808425412db99e1b65ed232fda36
Introduced
4a578260ec001580042b1c8b158d96992fc18beb
Last affected
c007939df9c05fd458f1e416d0969f1ed74b0ccd
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:10.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:10.0.0:milestone2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.17.0"
        },
        {
            "introduced": "10.0.0-milestone1"
        },
        {
            "last_affected": "10.0.0-milestone1"
        },
        {
            "introduced": "10.0.0-milestone2"
        },
        {
            "last_affected": "10.0.0-milestone2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

10.*
10.0.0-milestone1
10.0.0-milestone2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27439.json"