Test ID:	1.3.6.1.4.1.25623.1.0.807585
Category:	Web application abuses
Title:	Apache Wicket Multiple XSS Vulnerabilities (Mar 2016)
Summary:	Apache Wicket is prone to multiple cross-site scripting (XSS); vulnerabilities.
Description:	Summary: Apache Wicket is prone to multiple cross-site scripting (XSS) vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2015-7520: Insufficient validation of user supplied input via 'value' attribute in RadioGroup and CheckBoxMultipleChoice classes. - CVE-2015-5347: Insufficient validation of user supplied input via 'ModalWindow title' in getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow class. Vulnerability Impact: Successful exploitation will allow remote attackers to inject arbitrary web script or HTML. Affected Software/OS: Apache Wicket versions 1.5.x prior to 1.5.15, 6.x prior to 6.22.0 and 7.x prior to 7.2.0. Solution: Update to version 1.5.15, 6.22.0, 7.2.0 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5347 http://www.securitytracker.com/id/1035165 Common Vulnerability Exposure (CVE) ID: CVE-2015-7520 http://www.securitytracker.com/id/1035166
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.