org.apache.wicket:wicket-core@6.0.0-beta3

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through AutoLabelTextResolver in wicket-core/src/main/java/org/apache/wicket/markup/html/form/AutoLabelTextResolver.java. An attacker can inject markup or script into a form component label by supplying attacker-controlled label text through FormComponent#setLabel(IModel) or a resource bundle entry that is rendered by <wicket:label>. The resolver writes that label text into the page without escaping it, so the injected content is interpreted as markup in the generated response. This can lead to cross-site scripting or other client-side content injection when the application displays the affected label.

Upgrade org.apache.wicket:wicket-core to version 8.19.0, 9.24.0, 10.11.0 or higher.

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Directory Traversal through ResourceUtil.decodeResourceReferenceAttributes() and ResourceNameIterator in wicket-core. An unauthenticated attacker can read files outside the intended package, including WEB-INF resources, by sending a crafted resource URL whose decoded locale, style, or variation contains path separators. The affected code decodes those attributes from the request and splices them into the resource lookup path without validating that each value stays a single path component. On servlet containers that normalize .. in resource lookups, the resulting path can escape the package directory and expose application files that should not be served.

Upgrade org.apache.wicket:wicket-core to version 8.19.0, 9.24.0, 10.10.0 or higher.

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the MultipartServletWebRequestImpl servlet-part fallback via readServlet3Parts() in the wicket-core multipart upload path. An attacker can upload files larger than the configured per-file limit or submit more files than allowed by sending a multipart request that reaches HttpServletRequest#getParts() after another component has already consumed the body. In that fallback path, Wicket wrapped the servlet Part objects without reapplying Form#setFileMaxSize or Form#setFileCountMax, so uploads were processed as if those limits had been satisfied. Applications using Wicket upload forms, FileUploadToResourceField, or AjaxFileDropBehavior on deployments where a servlet or filter pre-parses multipart requests are affected.

Upgrade org.apache.wicket:wicket-core to version 8.19.0, 9.24.0, 10.11.0 or higher.

org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing and form handling is all handled in Java code using a first-class component model backed by POJO data beans that can easily be persisted using your favorite technology.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper neutralization of JavaScript in PopupSettings.java‎, Link.java, and ExternalLink.java markup. An attacker can execute arbitrary JavaScript code in the user's browser by injecting specially crafted strings.

Note: While the Apache Security Advisory suggests only versions above 8.x are affected, this is likely because 7.x and below are EoL as the vulnerable code has been traced to earlier versions.

Upgrade org.apache.wicket:wicket-core to version 10.9.0 or higher.