Threats tagged 'ghsa-58xq-c93x-4pwm'

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 have a vulnerability where Content-Security-Policy (CSP) headers are not set on pages if the render request handler is wrapped in more than one IRequestHandlerDelegate. This causes the framework to fail to apply nonce-based CSP protections on those pages, exposing them to potential content injection. Versions prior to 9.24.0 and 10.10.0 handled nested delegates correctly. The issue is fixed in versions 10.12.0 and 9.25.0.