{"id":"CVE-2017-15719","details":"In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.","aliases":["GHSA-pwpc-hqq2-hx2x"],"modified":"2026-07-08T10:55:29.468410Z","published":"2018-03-12T13:29:00.273Z","references":[{"type":"ADVISORY","url":"http://openmeetings.apache.org/security.html#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e"},{"type":"ADVISORY","url":"https://github.com/sebfz1/wicket-jquery-ui/wiki#cve-2017-15719---xss-in-wysiwyg-editor"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sebfz1/wicket-jquery-ui","events":[{"introduced":"dcb51ab95a979c336ce9db02c6df499fe8fb1b4f"},{"last_affected":"d007deedccfc44d764c15e8fe5a21a0f117bd51e"},{"introduced":"0"},{"last_affected":"60d133c01f41b4e6911301781f96cd8dd53e0d15"},{"introduced":"be7daa360d40c5f32f78a36ef056ab28e953d4d6"},{"last_affected":"261bda97e77bbc23b06574969509bf53b62ef265"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.1.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.1:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.7.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.8.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.0:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.1:*:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.0"},{"last_affected":"6.28.0"},{"introduced":"0"},{"last_affected":"7.9.1"},{"introduced":"7.0.0-NA"},{"last_affected":"7.0.0-NA"},{"introduced":"7.0.0-milestone3"},{"last_affected":"7.0.0-milestone3"},{"introduced":"7.0.0-milestone4"},{"last_affected":"7.0.0-milestone4"},{"introduced":"7.0.0-milestone5"},{"last_affected":"7.0.0-milestone5"},{"introduced":"7.0.0-milestone6"},{"last_affected":"7.0.0-milestone6"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"},{"introduced":"7.2.0"},{"last_affected":"7.2.0"},{"introduced":"7.2.1"},{"last_affected":"7.2.1"},{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"introduced":"7.3.1"},{"last_affected":"7.3.1"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"},{"introduced":"7.5.0"},{"last_affected":"7.5.0"},{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.7.0"},{"last_affected":"7.7.0"},{"introduced":"7.8.0"},{"last_affected":"7.8.0"},{"introduced":"7.9.0"},{"last_affected":"7.9.0"},{"introduced":"7.9.1"},{"introduced":"8.0.0-NA"},{"last_affected":"8.0.0-NA"},{"introduced":"8.0.0-milestone1"},{"last_affected":"8.0.0-milestone1"},{"introduced":"8.0.0-milestone1\\.1"},{"last_affected":"8.0.0-milestone1\\.1"},{"introduced":"8.0.0-milestone2"},{"last_affected":"8.0.0-milestone2"},{"introduced":"8.0.0-milestone3"},{"last_affected":"8.0.0-milestone3"},{"introduced":"8.0.0-milestone4"},{"last_affected":"8.0.0-milestone4"},{"introduced":"8.0.0-milestone4\\.1"},{"last_affected":"8.0.0-milestone4\\.1"},{"introduced":"8.0.0-milestone5"},{"last_affected":"8.0.0-milestone5"},{"introduced":"8.0.0-milestone6"},{"last_affected":"8.0.0-milestone6"},{"introduced":"8.0.0-milestone7"},{"last_affected":"8.0.0-milestone7"},{"introduced":"8.0.0-milestone8"},{"last_affected":"8.0.0-milestone8"}]}}],"versions":["7.0.0-NA","7.0.0-milestone3","7.0.0-milestone4","7.0.0-milestone5","7.0.0-milestone6","7.0.1","7.0.2","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0","7.9.0","7.9.1","8.0.0-NA","8.0.0-milestone1","8.0.0-milestone1\\.1","8.0.0-milestone2","8.0.0-milestone3","8.0.0-milestone4","8.0.0-milestone4\\.1","8.0.0-milestone5","8.0.0-milestone6","8.0.0-milestone7","8.0.0-milestone8","wicket-jquery-ui-parent-7.9.1","wicket-jquery-ui-8.0.0-M8","wicket-jquery-ui-6.28.0","wicket-jquery-ui-7.9.0","wicket-jquery-ui-8.0.0-M7","wicket-jquery-ui-7.8.0","wicket-jquery-ui-6.27.0","wicket-jquery-ui-7.7.0","wicket-jquery-ui-8.0.0-M6","wicket-jquery-ui-8.0.0-M5","wicket-jquery-ui-8.0.0-M4.1","wicket-jquery-ui-8.0.0-M4","wicket-jquery-ui-6.26.0","wicket-jquery-ui-7.6.0","wicket-jquery-ui-8.0.0-M3","wicket-jquery-ui-6.25.0","wicket-jquery-ui-7.5.0","wicket-jquery-ui-8.0.0-M2","wicket-jquery-ui-8.0.0-M1.1","wicket-jquery-ui-7.4.0","wicket-jquery-ui-6.24.0","wicket-jquery-ui-8.0.0-M1","wicket-jquery-ui-7.3.1","wicket-jquery-ui-7.3.0","wicket-jquery-ui-6.23.0","wicket-jquery-ui-6.22.2","wicket-jquery-ui-7.2.1","wicket-jquery-ui-6.22.1","wicket-jquery-ui-6.22.0","wicket-jquery-ui-6.21.2","wicket-jquery-ui-6.21.1","wicket-jquery-ui-7.2.0","wicket-jquery-ui-6.21.0","wicket-jquery-ui-7.1.0","wicket-jquery-ui-6.20.3","wicket-jquery-ui-6.20.2","wicket-jquery-ui-7.0.2","wicket-jquery-ui-6.20.1","wicket-jquery-ui-7.0.1","wicket-jquery-ui-7.0.0","wicket-jquery-ui-6.20.0","wicket-jquery-ui-6.19.1","wicket-jquery-ui-6.19.0","wicket-jquery-ui-6.18.1","wicket-jquery-ui-6.18.0","wicket-jquery-ui-6.17.0","wicket-jquery-ui-6.16.0","wicket-jquery-ui-6.15.0","wicket-jquery-ui-6.14.0","wicket-jquery-ui-6.13.1","wicket-jquery-ui-6.13.0","wicket-jquery-ui-6.12.0","wicket-jquery-ui-parent-6.11.0","wicket-jquery-ui-6.10.0","wicket-jquery-ui-6.9.1","wicket-jquery-ui-6.9.0","wicket-jquery-ui-6.8.1","wicket-jquery-ui-6.8.0","wicket-jquery-ui-6.7.0","wicket-jquery-1.4.2","wicket-jquery-ui-1.4.1","wicket-jquery-ui-1.4.0","wicket-jquery-ui-1.3.1","wicket-jquery-ui-1.3.0","wicket-jquery-ui-1.2.2","jquery-ui-parent-1.2.1","wicket-jquery-ui-1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15719.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}