CVE-2012-3373

Currently unrated

Key Information:

Vendor
Apache
Status
Wicket
Vendor
CVE Published:
19 September 2012

Summary

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.

References

http://www.securityfocus.com/bid/55445
vdb-entryx_refsource_BID
http://secunia.com/advisories/50555
third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/78321
vdb-entryx_refsource_XF

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.