Read the docs
TI-2017-11490 Aliases CVE-2017-15719GHSA-pwpc-hqq2-hx2x

Cross-site scripting in Apache Wicket jQuery UI

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.

Why it matters now

EPSS 0.00874 59th percentileScored 2026-11-07
Fix Fixed com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven): 6.28.1, 7.9.2, 8.0.0-M8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheWicket jQuery UIup to 6.28.0; up to 7.9.1; up to 8.0.0-M8—No fix listedCNA
—com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven)before 6.28.16.28.1Patch availableGHSA-pwpc-hqq2-hx2x
—com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven)7.0.0 to before 7.9.27.9.2Patch availableGHSA-pwpc-hqq2-hx2x
—com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven)8.0.0-M1 to before 8.0.0-M8.18.0.0-M8.1Patch availableGHSA-pwpc-hqq2-hx2x
  • Wicket jQuery UI VendorApache Affected up to 6.28.0; up to 7.9.1; up to 8.0.0-M8 Fixed in — No fix listed CNA
  • com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected before 6.28.1 Fixed in 6.28.1 Patch available GHSA-pwpc-hqq2-hx2x
  • com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected 7.0.0 to before 7.9.2 Fixed in 7.9.2 Patch available GHSA-pwpc-hqq2-hx2x
  • com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected 8.0.0-M1 to before 8.0.0-M8.1 Fixed in 8.0.0-M8.1 Patch available GHSA-pwpc-hqq2-hx2x

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:*6.0.0 – 6.28.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:*7.0.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:*7.0.0 milestone3VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:*7.0.0 milestone4VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:*7.0.0 milestone5VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:*7.0.0 milestone6VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableWicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.28.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:* Versions 7.0.0 milestone3 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:* Versions 7.0.0 milestone4 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:* Versions 7.0.0 milestone5 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:* Versions 7.0.0 milestone6 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Wicket-jquery-ui Project
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.1:*:*:*:*:*:*:*7.2.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.1:*:*:*:*:*:*:*7.3.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.5.0:*:*:*:*:*:*:*7.5.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.6.0:*:*:*:*:*:*:*7.6.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.7.0:*:*:*:*:*:*:*7.7.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.8.0:*:*:*:*:*:*:*7.8.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.0:*:*:*:*:*:*:*7.9.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.1:*:*:*:*:*:*:*7.9.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:*8.0.0VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:*8.0.0 milestone1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:*8.0.0 milestone1.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:*8.0.0 milestone2VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:*8.0.0 milestone3VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:*8.0.0 milestone4VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:*8.0.0 milestone4.1VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:*8.0.0 milestone5VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:*8.0.0 milestone6VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:*8.0.0 milestone7VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:*8.0.0 milestone8VulnerableWicket-jquery-ui Project
cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:*up to 7.9.1VulnerableWicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.8.0:*:*:*:*:*:*:* Versions 7.8.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.0:*:*:*:*:*:*:* Versions 7.9.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.1:*:*:*:*:*:*:* Versions 7.9.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:* Versions 8.0.0 milestone1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:* Versions 8.0.0 milestone1.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:* Versions 8.0.0 milestone2 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:* Versions 8.0.0 milestone3 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:* Versions 8.0.0 milestone4 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:* Versions 8.0.0 milestone4.1 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:* Versions 8.0.0 milestone5 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:* Versions 8.0.0 milestone6 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:* Versions 8.0.0 milestone7 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:* Versions 8.0.0 milestone8 Vulnerable ·Wicket-jquery-ui Project
  • cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:* Versions up to 7.9.1 Vulnerable ·Wicket-jquery-ui Project

Remediation

  • Fix · GHSA-pwpc-hqq2-hx2x com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 6.28.1 Advisory →
  • Fix · GHSA-pwpc-hqq2-hx2x com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 7.9.2 Advisory →
  • Fix · GHSA-pwpc-hqq2-hx2x com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 8.0.0-M8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15719
  2. 2026-10-03 Alias added: GHSA-pwpc-hqq2-hx2x

References

Advisory 3

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences