Description
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Wicket jQuery UI | <= 6.28.0, <= 7.9.1, <= 8.0.0-M8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent | < 6.28.1 | 6.28.1 | GHSA-pwpc-hqq2-hx2x |
| Maven | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent | >= 7.0.0, < 7.9.2 | 7.9.2 | GHSA-pwpc-hqq2-hx2x |
| Maven | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent | >= 8.0.0-M1, < 8.0.0-M8.1 | 8.0.0-M8.1 | GHSA-pwpc-hqq2-hx2x |