← Back

CVE-2018-1325

nvd nist
Published: Apr 18, 2018Modified: Nov 21, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Affected (21)

Wicket Jquery Ui Project
1 product
Wicket Jquery Ui
Configuration A
21 vulnerable
Vulnerable SoftwareAffected Versions
Wicket Jquery Ui
From 6.0.0 to 6.29.0
Wicket Jquery Ui
From 7.0.1 to 7.10.1
Wicket Jquery Ui
Version 7.0.0
Wicket Jquery Ui
Version 7.0.0 milestone3
Wicket Jquery Ui
Version 7.0.0 milestone4
Wicket Jquery Ui
Version 7.0.0 milestone5
Wicket Jquery Ui
Version 7.0.0 milestone6
Wicket Jquery Ui
Version 8.0.0
Wicket Jquery Ui
Version 8.0.0 milestone1.1
Wicket Jquery Ui
Version 8.0.0 milestone1
Wicket Jquery Ui
Version 8.0.0 milestone2
Wicket Jquery Ui
Version 8.0.0 milestone3
Wicket Jquery Ui
Version 8.0.0 milestone4.1
Wicket Jquery Ui
Version 8.0.0 milestone4
Wicket Jquery Ui
Version 8.0.0 milestone5
Wicket Jquery Ui
Version 8.0.0 milestone6
Wicket Jquery Ui
Version 8.0.0 milestone7
Wicket Jquery Ui
Version 8.0.0 milestone8.1
Wicket Jquery Ui
Version 8.0.0 milestone8
Wicket Jquery Ui
Version 8.0.0 milestone9.1
Wicket Jquery Ui
Version 8.0.0 milestone9

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.