---
layout: post
title: CVE-2015-7520 Apache Wicket XSS vulnerability
---

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Wicket 1.5.x, 6.x and 7.x

Description:

It is possible for JavaScript statements to break out of a RadioGroup's 
and CheckBoxMultipleChoice's "value" attribute of `<input>` elements

This might pose a security threat if the written JavaScript contains user provided data.

## The application developers are recommended to upgrade to: 
    
* [Apache Wicket 1.5.15](/news/2016/02/19/wicket-1.5.15-released.html)
* [Apache Wicket 6.22.0](/news/2016/02/19/wicket-6.22.0-released.html)
* [Apache Wicket 7.2.0](/news/2016/01/20/wicket-7.2.0-released.html)

Credit:
This issue was reported by Canh Ngo!

Apache Wicket Team