GHSA-64gv-3pqv-299hHighCVSS 7.5

Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket

Published
May 7, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-11976 →

📋 Description

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

🎯 Affected products7

  • maven/org.apache.wicket:wicket-core:< 7.17.0
  • maven/org.apache.wicket:wicket-core:>= 8.0.0, < 8.9.0
  • maven/org.apache.wicket:wicket-core:= 9.0.0-M1
  • maven/org.apache.wicket:wicket-core:= 9.0.0-M2
  • maven/org.apache.wicket:wicket-core:= 9.0.0-M3
  • maven/org.apache.wicket:wicket-core:= 9.0.0-M4
  • maven/org.apache.wicket:wicket-core:= 9.0.0-M5

🔗 References (10)