| I"|<p>Severity: Important</p> |
| |
| <p>Vendor: |
| The Apache Software Foundation</p> |
| |
| <p>Versions Affected: |
| Apache Wicket 1.4.x</p> |
| |
| <p>Apache Wicket 1.3.x and 1.5.x are not affected</p> |
| |
| <p>Description: |
| A Cross Site Scripting (XSS) attack is possible by manipulating the |
| value of ‘wicket:pageMapName’ request parameter.</p> |
| |
| <p>Mitigation: |
| Upgrade to <a href="http://wicket.apache.org/news/2012/03/12/wicket-1.4.20-released.html">Apache Wicket 1.4.20</a> or |
| <a href="http://wicket.apache.org/news/2012/03/12/wicket-1.5.5-released.html">Apache Wicket 1.5.5</a></p> |
| |
| <p>Credit: |
| This issue was discovered by Jens Schenck and Stefan Schmidt.</p> |
| :ET |
