CVE-2024-36522

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Wicket	>= 10.0.0-M1, <= 10.0.0; >= 9.0.0, <= 9.17.0; >= 8.0.0, <= 8.15.0
apache	wicket	>= 10.0.0-m1, <= 10.0.0; >= 8.0.0, <= 8.15.0; >= 9.0.0, <= 9.17.0

References

http://www.openwall.com/lists/oss-security/2024/07/12/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkcMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/07/12/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkcMailing List, Vendor Advisory

Timeline

Published: Jul 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-365236.5An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or CVE-2024-365269.8ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.CVE-2024-365276.5puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol CVE-2024-365288.8nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /ad CVE-2024-36535.3A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by d CVE-2024-365315.7nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.CVE-2024-3653210.0Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's t CVE-2024-365339.8Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's CVE-2024-365348.4Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service accoun CVE-2024-365359.8Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's CVE-2024-365369.8Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's CVE-2024-365377.2Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service acco