CVE-2020-11976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-11976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-11976
Aliases
Published
2020-08-11T19:15:17.220Z
Modified
2026-07-08T05:55:18.447608970Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:apache:fortress:2.0.5:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2.0.5"
                },
                {
                    "last_affected": "2.0.5"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "apache:fortress"
        }
    ]
}
References

Affected packages

Git / github.com/apache/wicket

Affected ranges

Type
GIT
Repo
https://github.com/apache/wicket
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2d92f60565fc0c5d5954ce6f313555b596197d6d
Introduced
5e789f1c98f6d57dba17f896c6220b0202af08a9
Fixed
c16442d69a2120a1d7453211bcffd68f56b629d7
Introduced
f911c636696a85fb1b81bdf1319667733c3e69fb
Last affected
e66ea49163d48852d17435954cc6a61277339553
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.17.0"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.9.0"
        },
        {
            "introduced": "9.0.0-milestone1"
        },
        {
            "last_affected": "9.0.0-milestone1"
        },
        {
            "introduced": "9.0.0-milestone2"
        },
        {
            "last_affected": "9.0.0-milestone2"
        },
        {
            "introduced": "9.0.0-milestone3"
        },
        {
            "last_affected": "9.0.0-milestone3"
        },
        {
            "introduced": "9.0.0-milestone4"
        },
        {
            "last_affected": "9.0.0-milestone4"
        },
        {
            "introduced": "9.0.0-milestone5"
        },
        {
            "last_affected": "9.0.0-milestone5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:9.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:9.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:9.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:9.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:wicket:9.0.0:milestone5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

9.*
9.0.0-milestone1
9.0.0-milestone2
9.0.0-milestone3
9.0.0-milestone4
9.0.0-milestone5
rel/wicket-9.*
rel/wicket-9.0.0-M5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11976.json"