CVE-2017-15719
Cross-site Scripting in wicket-jquery-ui
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
CVE-2017-15719- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
CVE-2017-15719- Updated
- 2026-11-02
EUVDEUVD-2022-4840 No score
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
EUVD-2022-4840- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwpc-hqq2-hx2x
Cross-site Scripting in wicket-jquery-ui
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
GHSA-pwpc-hqq2-hx2x- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
CVE-2017-15719- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-pwpc-hqq2-hx2x
Cross-site Scripting in wicket-jquery-ui
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Record
GHSA-pwpc-hqq2-hx2x- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
before 6.28.1 | 6.28.1 |
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
7.0.0 up to 7.9.2 | 7.9.2 |
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
8.0.0-M1 up to 8.0.0-M8.1 | 8.0.0-M8.1 |
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
before 6.28.1, plus listed versions 1.5.101.5.116.10.06.11.06.12.0 Show 34 moreShow less6.13.06.13.16.14.06.15.06.16.06.17.06.18.06.18.16.19.06.19.16.19.26.19.36.20.06.20.16.20.26.20.36.21.06.21.16.21.26.22.06.22.16.22.26.23.06.24.06.25.06.25.16.26.06.27.06.28.06.7.06.8.06.8.16.9.06.9.1 |
6.28.1 |
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
7.0.0 up to 7.9.2, plus listed versions 7.0.17.0.27.1.07.2.07.2.1 Show 9 moreShow less7.3.07.3.17.4.07.5.07.6.07.7.07.8.07.9.07.9.1 |
7.9.2 |
com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parentMaven |
8.0.0-M1 up to 8.0.0-M8.1, plus listed versions 8.0.0-M1.18.0.0-M28.0.0-M38.0.0-M48.0.0-M4.1 Show 4 moreShow less8.0.0-M58.0.0-M68.0.0-M78.0.0-M8 |
8.0.0-M8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15719 is a medium vulnerability (CVSS 6.1) in Apache Software Foundation Wicket Jquery Ui, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent 6.28.1.