CVE-2012-5636 Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors...
MediumCVSS 6.1
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wicket | = 1.4.0 | No fix listed |
| apache wicket | = 1.4.1 | No fix listed |
| apache wicket | = 1.4.2 | No fix listed |
| apache wicket | = 1.4.3 | No fix listed |
| apache wicket | = 1.4.4 | No fix listed |
| apache wicket | = 1.4.5 | No fix listed |
| apache wicket | = 1.4.6 | No fix listed |
| apache wicket | = 1.4.7 | No fix listed |
| apache wicket | = 1.4.8 | No fix listed |
| apache wicket | = 1.4.9 | No fix listed |
| apache wicket | = 1.4.10 | No fix listed |
| apache wicket | = 1.4.11 | No fix listed |
| apache wicket | = 1.4.12 | No fix listed |
| apache wicket | = 1.4.13 | No fix listed |
| apache wicket | = 1.4.14 | No fix listed |
| apache wicket | = 1.4.15 | No fix listed |
| apache wicket | = 1.4.16 | No fix listed |
| apache wicket | = 1.4.17 | No fix listed |
| apache wicket | = 1.4.18 | No fix listed |
| apache wicket | = 1.4.19 | No fix listed |
| apache wicket | = 1.4.20 | No fix listed |
| apache wicket | = 1.4.21 | No fix listed |
| apache wicket | = 1.5.0 | No fix listed |
| apache wicket | = 1.5.1 | No fix listed |
| apache wicket | = 1.5.2 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wicket | = 1.5.3 | No fix listed |
| apache wicket | = 1.5.4 | No fix listed |
| apache wicket | = 1.5.5 | No fix listed |
| apache wicket | = 1.5.6 | No fix listed |
| apache wicket | = 1.5.7 | No fix listed |
| apache wicket | = 1.5.8 | No fix listed |
| apache wicket | = 1.5.9 | No fix listed |
| apache wicket | = 6.0.0 | No fix listed |
| apache wicket | = 6.1.0 | No fix listed |
| apache wicket | = 6.1.1 | No fix listed |
| apache wicket | = 6.2.0 | No fix listed |
| apache wicket | = 6.3.0 | No fix listed |
References
- 101644 third-party-advisory vdb-entry
- wicket.apache.org patch vendor-advisory