Lucene search

RedhatCVE-2015-5347

HistoryApr 12, 2016 - 5:59 p.m.

CVE-2015-5347

2016-04-1217:59:00

CWE-79

redhat

web.nvd.nist.gov

cve-2015-5347

cross-site scripting

xss

apache wicket

vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.019

Percentile

88.6%

JSON

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.

Affected configurations

Nvd

Node

apachewicketRange1.5.0–1.5.15

apachewicketRange6.0.0–6.22.0

apachewicketRange7.0–7.2.0

VendorProductVersionCPE
apachewicket*cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	wicket	*	cpe:2.3:a:apache:wicket::::::::

References

wicket.apache.org/news/2016/03/01/cve-2015-5347.html

www.securitytracker.com/id/1035165

issues.apache.org/jira/browse/WICKET-6037

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.019

Percentile

88.6%

JSON

Related for CVE-2015-5347