I"!<p>Severity: Important</p>

<p>Vendor:
The Apache Software Foundation</p>

<p>Versions Affected:
Apache Wicket 1.4.x</p>

<p>Apache Wicket 1.3.x and 1.5-RCx are not affected</p>

<p>Description:
With multi window support application configuration and special query parameters it is possible to execute any kind of JavaScript on a site running with the affected versions.</p>

<p>Mitigation:
Either disable multi window support with</p>

<figure class="highlight"><pre><code class="language-java" data-lang="java"><span class="kd">public</span> <span class="kd">class</span> <span class="nc">MyApp</span> <span class="kd">extends</span> <span class="nc">WebApplication</span> <span class="o">{</span> 
    <span class="kd">public</span> <span class="kt">void</span> <span class="nf">init</span><span class="o">()</span> <span class="o">{</span>
        <span class="kd">super</span><span class="o">.</span><span class="na">init</span><span class="o">();</span>
        <span class="n">getPageSettings</span><span class="o">.</span><span class="na">setAutomaticMultiWindowSupport</span><span class="o">(</span><span class="kc">false</span><span class="o">);</span>
    <span class="o">}</span>
<span class="o">}</span></code></pre></figure>

<p>or upgrade to <a href="http://wicket.apache.org/news/2011/08/09/wicket-1.4.18-released.html">Apache Wicket 1.4.18</a> or
<a href="http://wicket.apache.org/news/2011/06/25/wicket-1.5-RC5.1-released.html">Apache Wicket 1.5-RC5.1</a></p>

<p>Credit:
This issue was discovered by ﻿Sven Krewitt of TÜV Rheinland i-sec GmbH.</p>
:ET