VulnerabilityAnalyzed
CVE-2024-27439
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
MEDIUM 6.5EPSS 0.68%
Does this matter?
Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.
Description
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected. Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.68% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352, CWE-444
- Affected
- apache/wicket
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2024/03/19/2Mailing List
- https://lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1loMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/03/19/2Mailing List
- https://lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1loMailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.