Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28538
HistorySep 07, 2012 - 12:00 a.m.

[CVE-2012-3373] Apache Wicket XSS vulnerability via manipulated URL parameter

2012-09-0700:00:00
vulners.com
42

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Wicket 1.4.x and 1.5.x

Description:
https://wicket.apache.org/2012/09/06/cve-2012-3373.html
It is possible to inject JavaScript statements into an ajax link by
adding an encoded null byte to a URL pointing to a Wicket app. This
could be done by sending a legitimate user a manipulated URL and
tricking the user into clicking on it.

This vulnerability is fixed in

Apache Wicket 6.0.0 is not affected.

Credit:
This issue was reported by Thomas Heigl.

Apache Wicket Team

Related for SECURITYVULNS:DOC:28538