CVE-2012-3373

Published: Sep 19, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.

Affected (28)

Products: Apache: Wicket

Apache

1 product

Wicket

Configuration A

20 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apache Wicket	Version 1.4.10
Apache Wicket	Version 1.4.11
Apache Wicket	Version 1.4.12
Apache Wicket	Version 1.4.13
Apache Wicket	Version 1.4.14
Apache Wicket	Version 1.4.15
Apache Wicket	Version 1.4.16
Apache Wicket	Version 1.4.17
Apache Wicket	Version 1.4.18
Apache Wicket	Version 1.4.19
Apache Wicket	Version 1.4.1
Apache Wicket	Version 1.4.20
Apache Wicket	Version 1.4.2
Apache Wicket	Version 1.4.3
Apache Wicket	Version 1.4.4
Apache Wicket	Version 1.4.5
Apache Wicket	Version 1.4.6
Apache Wicket	Version 1.4.7
Apache Wicket	Version 1.4.8
Apache Wicket	Version 1.4.9

Running on/with	Platform Versions
Apache Wicket	Version 1.4.0

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Apache Wicket	Version 1.5.0
Apache Wicket	Version 1.5.1
Apache Wicket	Version 1.5.2
Apache Wicket	Version 1.5.3
Apache Wicket	Version 1.5.4
Apache Wicket	Version 1.5.5
Apache Wicket	Version 1.5.6
Apache Wicket	Version 1.5.7