CVE-2011-2712 Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspec...
LowCVSS 2.6
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wicket | = 1.4.0 | No fix listed |
| apache wicket | = 1.4.1 | No fix listed |
| apache wicket | = 1.4.2 | No fix listed |
| apache wicket | = 1.4.3 | No fix listed |
| apache wicket | = 1.4.4 | No fix listed |
| apache wicket | = 1.4.5 | No fix listed |
| apache wicket | = 1.4.6 | No fix listed |
| apache wicket | = 1.4.7 | No fix listed |
| apache wicket | = 1.4.8 | No fix listed |
| apache wicket | = 1.4.9 | No fix listed |
| apache wicket | = 1.4.10 | No fix listed |
| apache wicket | = 1.4.11 | No fix listed |
| apache wicket | = 1.4.12 | No fix listed |
| apache wicket | = 1.4.13 | No fix listed |
| apache wicket | = 1.4.14 | No fix listed |
| apache wicket | = 1.4.15 | No fix listed |
| apache wicket | = 1.4.16 | No fix listed |
| apache wicket | = 1.4.17 | No fix listed |
References
- 45727 third-party-advisory vendor-advisory
- 8357 third-party-advisory
- wicket.apache.org vendor-advisory
- 20110823 [CVE-2011-2712] Apache Wicket XSS vulnerability mailing-list
- 49290 vdb-entry
- 1025976 vdb-entry
- apache-wicket-multi-window-xss(69394) vdb-entry