Description

In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Remediation

References

https://markmail.org/message/6bxjyaolehhq7jrl

Related Vulnerabilities

CVE-2019-10453 Vulnerability in maven package org.jenkins-ci.plugins:delphix

CVE-2022-35916 Vulnerability in npm package @openzeppelin/contracts-upgradeable

CVE-2019-10401 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2018-20433 Vulnerability in maven package c3p0:c3p0

CVE-2022-25916 Vulnerability in npm package mt7688-wiscan

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory