CVE-2015-7520 Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow rem...
MediumCVSS 6.1
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wicket | >= 1.5.0, < 1.5.15 | 1.5.15 |
| apache wicket | >= 6.0.0, < 6.22.0 | 6.22.0 |
| apache wicket | >= 7.0.0, < 7.2.0 | 7.2.0 |
References
- wicket.apache.org vendor-advisory
- 1035166 third-party-advisory vdb-entry