« Volver al listado

CVE-2024-53299

Estado: AnalizadaMedia (6.5)—

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Wicket

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53299",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53299",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T18:52:21.123757Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Wicket",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.18.*"
            },
            {
              "status": "affected",
              "version": "8.0.0-M1",
              "versionType": "semver",
              "lessThanOrEqual": "8.16.*"
            },
            {
              "status": "affected",
              "version": "9.0.0-M1",
              "versionType": "semver",
              "lessThanOrEqual": "9.18.*"
            },
            {
              "status": "affected",
              "version": "10.0.0-M1",
              "versionType": "semver",
              "lessThanOrEqual": "10.2.*"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-23T09:15:07.033",
  "references": [
    {
      "url": "https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/01/22/12",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.\nUsers are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue."
    },
    {
      "lang": "es",
      "value": "La gestión de solicitudes en el núcleo de Apache Wicket 7.0.0 en cualquier plataforma permite a un atacante crear un ataque de denegación de servicio (DOS) mediante múltiples solicitudes a los recursos del servidor. Se recomienda a los usuarios actualizar a las versiones 9.19.0 o 10.3.0, que solucionan este problema."
    }
  ],
  "lastModified": "2026-06-17T08:08:46.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89F22F1D-1719-4BA0-AF01-4991D7C51BB4",
              "versionEndIncluding": "7.18.0",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E82E304-3D91-42D1-BA33-67D3C506F817",
              "versionEndIncluding": "8.16.0",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1930820D-7167-480E-B2ED-7B54BFA139CF",
              "versionEndExcluding": "9.19.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEF67075-6C48-4C2E-BDAC-ED904916ABF8",
              "versionEndExcluding": "10.3.0",
              "versionStartIncluding": "10.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}