CVE-2024-27439

Apache Wicket: Possible bypass of CSRF protection

State: Published
Severity: 6.5 Medium
Published: Mar 19, 2024
Updated: Feb 13, 2025
Reserved: Feb 25, 2024

Description

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Affected Products

Product	Versions
Apache WicketApache Software Foundation	9.1.0 through 9.16.0Affected 10.0.0-M1 to before 10.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.