GitHub Advisoryadvisory · Maven

GHSA-pjv3-rh6v-2pj8 Cross-site Scripting in wicket-jquery-ui

MEDIUM Published 2022-05-14 Modified 2022-11-03 Official page ↗
Aliases
CVE-2018-1325
Ecosystem
Maven
Packages
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-03

Affected packages

• Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent: < 6.29.1 → fixed in 6.29.1 • Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent: >= 7.0.0, < 7.10.2 → fixed in 7.10.2 • Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent: >= 8.0.0-M1, < 8.0.0-M9.2 → fixed in 8.0.0-M9.2

Description

In wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Related

Alias · CVE (1)

  • CVE-2018-1325 In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References