Threats tagged 'ghsa-c66q-rm6m-7cvq'

Apache Wicket versions 8.0.0 through 8.19.0 contain a vulnerability where improper neutralization of input occurs during web page generation. Specifically, the ExternalLink component improperly escapes URLs when bound to non-anchor markup tags, allowing an attacker-controlled URL to break out of a JavaScript string literal and execute arbitrary script in the application's origin. This issue requires user interaction to trigger and affects applications that use ExternalLink with attacker-influenced URLs in non-anchor elements. The vulnerability is fixed in Apache Wicket version 8.20.0.