CVE-2017-15719 Cross-site Scripting in wicket-jquery-ui

What is CVE-2017-15719?

CVE-2017-15719 is a medium-severity cross-site scripting vulnerability in Apache Software Foundation Wicket jQuery UI, published on 12 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.

Weakness: CWE-79

Which versions are affected by CVE-2017-15719?

6 open source packages ship an affected version, including com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent. It affects 1 product.

Products include Wicket-Jquery-Ui Project Wicket-Jquery-Ui.

How do I fix CVE-2017-15719?

Upgrade com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent to a fixed version for your release line: 6.28.1, 7.9.2 or 8.0.0-M8.1.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-15719 being exploited?

There is no known exploitation of CVE-2017-15719 in the wild and no public exploit code.

Other vulnerabilities in Apache Software Foundation Wicket jQuery UI

• CVE-2018-1325 Cross-site Scripting in wicket-jquery-ui Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pwpc-hqq2-hx2x.