Wicket
Monthly
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.
Path traversal in Apache Wicket's package resource URL handling exposes files outside the intended package directory to unauthenticated remote attackers, including files under WEB-INF that servlet containers ordinarily protect from direct access. Affected are all releases from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Under default configuration the readable file set is bounded by the SecurePackageResourceGuard's extension allowlist (excluding .xml, .properties, .class), but all configurations unconditionally expose a path-existence oracle usable for reconnaissance, and applications using looser guard configurations can disclose web.xml and other sensitive configuration files. No public exploit identified at time of analysis.
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.
Path traversal in Apache Wicket's package resource URL handling exposes files outside the intended package directory to unauthenticated remote attackers, including files under WEB-INF that servlet containers ordinarily protect from direct access. Affected are all releases from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Under default configuration the readable file set is bounded by the SecurePackageResourceGuard's extension allowlist (excluding .xml, .properties, .class), but all configurations unconditionally expose a path-existence oracle usable for reconnaissance, and applications using looser guard configurations can disclose web.xml and other sensitive configuration files. No public exploit identified at time of analysis.
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.