PT-2024-2472 · Apache · Apache Wicket

Jo Theunis · Published 2024-03-19 · Updated 2025-06-27 · CVE-2024-27439

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 9.1.0 through 9.16.0 Apache Wicket milestone releases for the 10.0 series

Description The issue is related to a bypass of the CSRF protection in Apache Wicket due to an error in the evaluation of the fetch metadata headers. This could allow a remote attacker to perform a CSRF attack using a specially crafted web page. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Apache Wicket versions 9.1.0 through 9.16.0, upgrade to version 9.17.0. For Apache Wicket milestone releases for the 10.0 series, upgrade to version 10.0.0. As a temporary workaround, consider restricting access to sensitive operations that rely on CSRF protection until a patch is applied.

Fix

HTTP Request/Response Smuggling

CSRF

Weakness Enumeration

CWE-444

CWE-352

Related Identifiers

BDU:2024-02450

CVE-2024-27439

GHSA-8VVP-525H-CXF9

Affected Products

Apache Wicket

References · 15

• https://osv.dev/vulnerability/CVE-2024-27439 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vvp-525h-cxf9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02450 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27439 · Security Note
• https://lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1lo · Vendor Advisory
• https://github.com/apache/wicket · Note
• https://t.me/cvenotify/74233 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1770065401751146518 · Twitter Post
• https://t.me/cvenotify/103411 · Telegram Post
• https://twitter.com/oss_security/status/1770090935478632492 · Twitter Post
• http://openwall.com/lists/oss-security/2024/03/19/2 · Note
• https://t.me/cvenotify/126892 · Telegram Post
• https://twitter.com/CVEnew/status/1770045942533673090 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024031523 · Note
• https://access.redhat.com/security/cve/CVE-2024-27439 · Note