CVE-2017-15719

Vulnerability

The vulnerability exists in the WYSIWYG editor component of Wicket jQuery UI. Affected artifacts include wicket-jquery-ui-plugins (class WysiwygEditor) and wicket-kendo-ui (class Editor). Versions 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier are vulnerable [1][2][3]. The editor fails to sanitize user input, allowing injection of arbitrary JavaScript code.

Exploitation

An attacker can submit arbitrary JS code to the WYSIWYG editor. This requires the attacker to have the ability to input content into the editor (e.g., via a web form). No authentication or special privileges are mentioned in the references, but typical usage implies the user is logged in. The attacker crafts malicious JavaScript and submits it through the editor.

Impact

Successful exploitation leads to Cross-Site Scripting (XSS), allowing the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions depending on the application's context.

Mitigation

The issue is fixed in versions 6.28.1, 7.9.2, and 8.0.0-M8.1 [1][3]. Users are recommended to upgrade to the latest available version (6.29.0, 7.10.1, 8.0.0-M9.1) [3]. For Apache OpenMeetings, upgrading to a version that includes the fix is necessary [1].