Skip to content
OpenAdvisories
Medium · 6.1 CVE-2018-1325 EUVD-2022-4788GHSA-pjv3-rh6v-2pj8

Cross-site Scripting in wicket-jquery-ui

Published Apr 18, 2018 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Wicket jQuery UI Package: com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent Ecosystem: Maven

Description

In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Affected products

VendorProductAffectedFixed
Apache Software Foundation wicket-jquery-ui wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent < 6.29.1 6.29.1 GHSA-pjv3-rh6v-2pj8
Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent >= 7.0.0, < 7.10.2 7.10.2 GHSA-pjv3-rh6v-2pj8
Maven com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent >= 8.0.0-M1, < 8.0.0-M9.2 8.0.0-M9.2 GHSA-pjv3-rh6v-2pj8

References