CVE-2012-5636

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101644Third Party Advisory, VDB Entry
https://wicket.apache.org/news/2013/03/03/cve-2012-5636.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/101644Third Party Advisory, VDB Entry
https://wicket.apache.org/news/2013/03/03/cve-2012-5636.htmlPatch, Vendor Advisory

Timeline

Published: Oct 30, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56383.6The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwri CVE-2012-56396.5LibreOffice and OpenOffice automatically open embedded content CVE-2012-56405.5thttpd has a local DoS vulnerability via specially-crafted .htpasswd files CVE-2012-56415.0Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before CVE-2012-56427.5server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to tri CVE-2012-56435.0Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 CVE-2012-56445.5libuser has information disclosure when moving user's home directory CVE-2012-56457.5A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker coul CVE-2012-56467.5node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a c CVE-2012-56475.8Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirec CVE-2012-56487.5Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified para CVE-2012-56496.8Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callba