Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-27439

Apache Wicket: Possible bypass of CSRF protection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected. Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Wicket

Default version status: unaffected

  • 9.1.0 to ≤ 9.16.0affected
  • 10.0.0-M1 to < 10.0.0affected

References