CVE-2018-1325

Vulnerability

In Apache wicket-jquery-ui versions 6.29.0 and earlier, 7.10.1 and earlier, and 8.0.0-M9.1 and earlier, JavaScript code created in the WYSIWYG editor is executed when the content is displayed, leading to a stored cross-site scripting (XSS) vulnerability [1].

Exploitation

An attacker with write access to the WYSIWYG editor can inject malicious JavaScript code into the input. When the crafted content is rendered in a browser, the injected script executes in the context of the viewer's session [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to information disclosure, session hijacking, or other malicious actions [1].

Mitigation

Upgrade to a version later than the affected ones: for the 6.x line, upgrade to 6.29.1 or later; for 7.x, upgrade to 7.10.2 or later; for 8.x, upgrade to 8.0.0-M10 or later. No workaround is documented [1].