CVE-2012-3373

CVE-2012-3373 affects Apache Wicket 1.4.x and 1.5.x. The vulnerability is XSS via a manipulated URL parameter (encoded null byte) in an Ajax link, allowing injection of arbitrary script/HTML in Wicket apps. Root cause: handling of a %00 sequence in the Ajax link URL. Impact: remote attacker can e...