CVE-2024-27439CWE-352CWE-444

Apache Wicket: Possible bypass of CSRF protection

Medium · published March 19, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.

This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.

Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.9th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2024-03-19T11:07Z
EPSS history
Timeline
  • 19 MAR 11:07Z
    Apache Wicket: Possible bypass of CSRF protection
    cvelistv5