| <!DOCTYPE html> |
| <html> |
| <head> |
| <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> |
| <meta charset="utf-8"> |
| |
| |
| |
| <title>CVE-2011-2712 - Apache Wicket XSS vulnerability | Apache Wicket</title> |
| <meta name="viewport" content="width=device-width, initial-scale=1" /> |
| |
| <link rel="shortcut icon" href="/favicon.ico" type="image/vnd.microsoft.icon" /> |
| <link rel="stylesheet" href="/css/style.css" type="text/css" media="screen" /> |
| <link href="//maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet" /> |
| |
| <script src="//code.jquery.com/jquery-1.11.3.min.js"></script> |
| |
| |
| </head> |
| <body class=""> |
| <div class="header default"> |
| <div class="l-container"> |
| |
| <nav class="mainmenu"> |
| <div class="nav-logo"> |
| <a href="/"><img src="/img/logo-apachewicket.svg" alt="Apache Wicket"></a> |
| </div> |
| |
| <div class="nav-container"> |
| |
| |
| |
| |
| |
| <!-- /start/quickstart.html || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/start/quickstart.html" class=" nav-items">Quick Start</a> |
| |
| |
| |
| |
| |
| <!-- /start/download.html || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/start/download.html" class=" nav-items">Download</a> |
| |
| |
| |
| |
| |
| <!-- /learn || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/learn" class=" nav-items">Documentation</a> |
| |
| |
| |
| |
| |
| <!-- /help || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/help" class=" nav-items">Support</a> |
| |
| |
| |
| |
| |
| <!-- /contribute || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/contribute" class=" nav-items">Contribute</a> |
| |
| |
| |
| |
| |
| <!-- /community || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/community" class=" nav-items">Community</a> |
| |
| |
| |
| |
| |
| <!-- /apache || /news/2011/08/23/cve-2011-2712.html --> |
| |
| |
| |
| <a href="/apache" class=" nav-items">Apache</a> |
| |
| </div> |
| <div class="nav-container "> |
| <a href="https://github.com/apache/wicket" target="_blank"><i class="fa fa-github nav-items"></i></a> |
| <a href="https://twitter.com/apache_wicket" target="_blank"><i class="fa fa-twitter nav-items"></i></a> |
| <a href="https://builtwithwicket.tumblr.com" target="_blank"><i class="fa fa-tumblr nav-items"></i></a> |
| </div> |
| </nav> |
| |
| </div> |
| </div> |
| <main> |
| <div class="l-container"> |
| <header class="l-full preamble"> |
| <h1>CVE-2011-2712 - Apache Wicket XSS vulnerability</h1> |
| |
| |
| |
| </header> |
| <section class="toc left post "> |
| |
| </section> |
| <section> |
| <div class="l-full"> |
| <p class="meta">23 Aug 2011</p> |
| <p>Severity: Important</p> |
| |
| <p>Vendor: |
| The Apache Software Foundation</p> |
| |
| <p>Versions Affected: |
| Apache Wicket 1.4.x</p> |
| |
| <p>Apache Wicket 1.3.x and 1.5-RCx are not affected</p> |
| |
| <p>Description: |
| With multi window support application configuration and special query parameters it is possible to execute any kind of JavaScript on a site running with the affected versions.</p> |
| |
| <p>Mitigation: |
| Either disable multi window support with</p> |
| |
| <figure class="highlight"><pre><code class="language-java" data-lang="java"><span class="kd">public</span> <span class="kd">class</span> <span class="nc">MyApp</span> <span class="kd">extends</span> <span class="nc">WebApplication</span> <span class="o">{</span> |
| <span class="kd">public</span> <span class="kt">void</span> <span class="nf">init</span><span class="o">()</span> <span class="o">{</span> |
| <span class="kd">super</span><span class="o">.</span><span class="na">init</span><span class="o">();</span> |
| <span class="n">getPageSettings</span><span class="o">.</span><span class="na">setAutomaticMultiWindowSupport</span><span class="o">(</span><span class="kc">false</span><span class="o">);</span> |
| <span class="o">}</span> |
| <span class="o">}</span></code></pre></figure> |
| |
| <p>or upgrade to <a href="http://wicket.apache.org/news/2011/08/09/wicket-1.4.18-released.html">Apache Wicket 1.4.18</a> or |
| <a href="http://wicket.apache.org/news/2011/06/25/wicket-1.5-RC5.1-released.html">Apache Wicket 1.5-RC5.1</a></p> |
| |
| <p>Credit: |
| This issue was discovered by Sven Krewitt of TÜV Rheinland i-sec GmbH.</p> |
| |
| </div> |
| |
| |
| </section> |
| </div> |
| </main> |
| |
| <footer> |
| <div class="l-container"> |
| <div class="left"> |
| <img src="/img/asf_logo_url.svg" style="height:90px; float:left; margin-right:10px;"> |
| <div style="margin-top:12px;">Copyright © 2021 — The Apache Software Foundation. Apache Wicket, Wicket, Apache, the Apache feather logo, and the Apache Wicket project logo are trademarks of The Apache Software Foundation. All other marks mentioned may be trademarks or registered trademarks of their respective owners.</div> |
| </div> |
| </div> |
| |
| </footer> |
| </body> |
| </html> |
