CVE-2011-2712

Apache Wicket - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

References (7)

[Vendor Advisory] http://secunia.com/advisories/45727

[Third Party Advisory] http://securityreason.com/securityalert/8357

[Vendor Advisory] http://wicket.apache.org/2011/08/23/cve-2011-2712.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1025976

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/69394

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/519398/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/49290

Scores

EPSS 0.0537

EPSS Percentile 90.0%

Classification

CWE

CWE-79

Status published

Affected Products (19)

apache/wicket

... and 4 more

Timeline

Published Aug 29, 2011

Tracked Since Feb 18, 2026