CVE-2020-11976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-11976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-11976
Aliases
Published
2020-08-11T19:15:17.220Z
Modified
2026-04-10T04:21:55.302099Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

References

Affected packages

Git / github.com/apache/wicket

Affected ranges

Type
GIT
Repo
https://github.com/apache/wicket
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2d92f60565fc0c5d5954ce6f313555b596197d6d
Introduced
5e789f1c98f6d57dba17f896c6220b0202af08a9
Fixed
c16442d69a2120a1d7453211bcffd68f56b629d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f911c636696a85fb1b81bdf1319667733c3e69fb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
96296e2b54b837fde33fe5463eb0123d0ce6d09f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
65f71c8ee972a96e15b5e5188d4edaef230193e9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c35ae7a2fe3af8301a905d3725ca2a6317f338eb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e66ea49163d48852d17435954cc6a61277339553
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.17.0"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.9.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-milestone1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-milestone2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-milestone3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-milestone4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-milestone5"
        }
    ]
}

Affected versions

rel/wicket-9.*
rel/wicket-9.0.0-M1
rel/wicket-9.0.0-M2
rel/wicket-9.0.0-M3
rel/wicket-9.0.0-M4
rel/wicket-9.0.0-M5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11976.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.0.5"
            }
        ]
    }
]