Description

In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Remediation

References

https://markmail.org/message/6bxjyaolehhq7jrl

Related Vulnerabilities

CVE-2021-39150 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2020-2184 Vulnerability in maven package org.jenkins-ci.plugins:cvs

CVE-2020-2274 Vulnerability in maven package org.jenkins-ci.plugins:elastestv

CVE-2022-36914 Vulnerability in maven package org.jenkins-ci.plugins:files-found-trigger

CVE-2019-10790 Vulnerability in npm package taffy

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory