bugtraq - [CVE-2012-3373] Apache Wicket XSS vulnerability via manipulated URL parameter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20120906153745.2a2ec885@robotron.sg.de.pri.o2.com>
Date: Thu, 6 Sep 2012 15:37:45 +0200
From: Carl-Eric Menzel <cmenzel@...ketbuch.de>
To: announce@...ket.apache.org, users@...ket.apache.org, dev@...ket.apache.org
Cc: security@...che.org, full-disclosure@...ts.grok.org.uk,
  bugtraq@...urityfocus.com
Subject: [CVE-2012-3373] Apache Wicket XSS vulnerability via manipulated URL
 parameter

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Wicket 1.4.x and 1.5.x

Description:
https://wicket.apache.org/2012/09/06/cve-2012-3373.html
It is possible to inject JavaScript statements into an ajax link by
adding an encoded null byte to a URL pointing to a Wicket app. This
could be done by sending a legitimate user a manipulated URL and
tricking the user into clicking on it.

This vulnerability is fixed in
- Apache Wicket 1.4.21
  https://wicket.apache.org/2012/09/05/wicket-1.4.21-released.html
- Apache Wicket 1.5.8
  https://wicket.apache.org/2012/08/24/wicket-1.5.8-released.html

Apache Wicket 6.0.0 is not affected.

Credit:
This issue was reported by Thomas Heigl.

Apache Wicket Team