diff --git a/advisories/github-reviewed/2025/01/GHSA-9cxr-76pm-j3wf/GHSA-9cxr-76pm-j3wf.json b/advisories/github-reviewed/2025/01/GHSA-9cxr-76pm-j3wf/GHSA-9cxr-76pm-j3wf.json index f9f93204a77..7ab753a69f7 100644 --- a/advisories/github-reviewed/2025/01/GHSA-9cxr-76pm-j3wf/GHSA-9cxr-76pm-j3wf.json +++ b/advisories/github-reviewed/2025/01/GHSA-9cxr-76pm-j3wf/GHSA-9cxr-76pm-j3wf.json @@ -1,14 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-9cxr-76pm-j3wf", - "modified": "2025-01-23T22:31:09Z", + "modified": "2025-03-11T16:24:16Z", "published": "2025-01-23T09:31:17Z", "aliases": [ "CVE-2024-53299" ], "summary": "Apache Wicket: An attacker can intentionally trigger a memory leak", "details": "The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.\nUsers are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [ { "package": { @@ -23,7 +28,7 @@ "introduced": "7.0.0" }, { - "fixed": "9.19.0" + "fixed": "8.17.0" } ] } @@ -47,6 +52,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.wicket:wicket-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.19.0" + } + ] + } + ] } ], "references": [ @@ -62,6 +86,10 @@ "type": "WEB", "url": "https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5" }, + { + "type": "WEB", + "url": "https://wicket.apache.org/news/2025/01/31/wicket-8.17.0-released.html" + }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/01/22/12" @@ -71,7 +99,7 @@ "cwe_ids": [ "CWE-400" ], - "severity": "CRITICAL", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-23T22:31:09Z", "nvd_published_at": "2025-01-23T09:15:07Z"