Ho1Aas

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 8.0.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Apache Wicket versions 6.22.0 and earlier Apache Wicket versions 1.4.0 and earlier **Description** Cross-site scripting is possible in `AjaxEditableChoiceLabel` within wicket-extensions when used with a non-null `IChoiceRenderer`. The component writes the display value from the renderer into the markup without applying default HTML escaping. Additionally, `AjaxEditableLabel`, `AjaxEditableChoiceLabel`, and `AjaxEditableMultiLineLabel` fail to escape values returned by the `defaultNullLabel()` method when the model is empty. This allows an attacker who can influence the choice, model data, or the overridden `defaultNullLabel()` method to inject HTML or scripts into the browser of users viewing the page. The `escapeModelStrings` configuration does not mitigate this issue as it is not passed to the underlying label. **Recommendations** Upgrade versions 8.0.0 through 8.18.0 to 8.19.0. Upgrade versions 9.0.0 through 9.23.0 to 9.24.0. Upgrade versions 10.0.0 through 10.10.0 to 10.11.0.

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 1.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** Improper neutralization of input during web page generation occurs via the `<wicket:label>` tag provided by `org.apache.wicket.markup.html.form.AutoLabelTextResolver`. The resolver writes labels into the markup without escaping, causing any markup within a label to be rendered as active markup. This occurs when the label of a form component, set through `FormComponent#setLabel(IModel)`, contains data that can be influenced by an attacker. **Recommendations** Upgrade to version 8.19.0 Upgrade to version 9.24.0 Upgrade to version 10.11.0