Lucene search

RedhatCVE-2011-2712

HistoryAug 29, 2011 - 3:55 p.m.

CVE-2011-2712

2011-08-2915:55:01

CWE-79

redhat

web.nvd.nist.gov

cve-2011-2712

cross-site scripting

xss

apache wicket 1.4.x

security vulnerability

web script injection

html injection

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Affected configurations

Nvd

Node

apachewicketMatch1.4.0

apachewicketMatch1.4.1

apachewicketMatch1.4.2

apachewicketMatch1.4.3

apachewicketMatch1.4.4

apachewicketMatch1.4.5

apachewicketMatch1.4.6

apachewicketMatch1.4.7

apachewicketMatch1.4.8

apachewicketMatch1.4.9

apachewicketMatch1.4.10

apachewicketMatch1.4.11

apachewicketMatch1.4.12

apachewicketMatch1.4.13

apachewicketMatch1.4.14

apachewicketMatch1.4.15

apachewicketMatch1.4.16

apachewicketMatch1.4.17

VendorProductVersionCPE
apachewicket1.4.0cpe:2.3:a:apache:wicket:1.4.0:*:*:*:*:*:*:*
apachewicket1.4.1cpe:2.3:a:apache:wicket:1.4.1:*:*:*:*:*:*:*
apachewicket1.4.2cpe:2.3:a:apache:wicket:1.4.2:*:*:*:*:*:*:*
apachewicket1.4.3cpe:2.3:a:apache:wicket:1.4.3:*:*:*:*:*:*:*
apachewicket1.4.4cpe:2.3:a:apache:wicket:1.4.4:*:*:*:*:*:*:*
apachewicket1.4.5cpe:2.3:a:apache:wicket:1.4.5:*:*:*:*:*:*:*
apachewicket1.4.6cpe:2.3:a:apache:wicket:1.4.6:*:*:*:*:*:*:*
apachewicket1.4.7cpe:2.3:a:apache:wicket:1.4.7:*:*:*:*:*:*:*
apachewicket1.4.8cpe:2.3:a:apache:wicket:1.4.8:*:*:*:*:*:*:*
apachewicket1.4.9cpe:2.3:a:apache:wicket:1.4.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	wicket	1.4.0	cpe:2.3:a:apache:wicket:1.4.0:::::::*
apache	wicket	1.4.1	cpe:2.3:a:apache:wicket:1.4.1:::::::*
apache	wicket	1.4.2	cpe:2.3:a:apache:wicket:1.4.2:::::::*
apache	wicket	1.4.3	cpe:2.3:a:apache:wicket:1.4.3:::::::*
apache	wicket	1.4.4	cpe:2.3:a:apache:wicket:1.4.4:::::::*
apache	wicket	1.4.5	cpe:2.3:a:apache:wicket:1.4.5:::::::*
apache	wicket	1.4.6	cpe:2.3:a:apache:wicket:1.4.6:::::::*
apache	wicket	1.4.7	cpe:2.3:a:apache:wicket:1.4.7:::::::*
apache	wicket	1.4.8	cpe:2.3:a:apache:wicket:1.4.8:::::::*
apache	wicket	1.4.9	cpe:2.3:a:apache:wicket:1.4.9:::::::*

Rows per page:

1-10 of 181

References

secunia.com/advisories/45727

securityreason.com/securityalert/8357

wicket.apache.org/2011/08/23/cve-2011-2712.html

www.securityfocus.com/archive/1/519398/100/0/threaded

www.securityfocus.com/bid/49290

www.securitytracker.com/id?1025976

exchange.xforce.ibmcloud.com/vulnerabilities/69394

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Related for CVE-2011-2712