GHSA-64gv-3pqv-299h

Source

https://github.com/advisories/GHSA-64gv-3pqv-299h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-64gv-3pqv-299h

Aliases

CVE-2020-11976

Published

2021-05-07T15:54:15Z

Modified

2023-11-08T04:02:08Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket

Details

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-552"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-05-05T22:31:00Z",
    "nvd_published_at":  "2020-08-11T19:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.17.0

Affected versions

1.*

1.5-RC1

1.5-rc2

1.5-RC3

1.5-RC4.2

1.5-RC5.1

1.5-RC7

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.14

1.5.15

1.5.16

1.5.17

6.*

6.0.0-beta1

6.0.0-beta2

6.0.0-beta3

6.0.0

6.1.0

6.1.1

6.2.0

6.3.0

6.4.0

6.5.0

6.6.0

6.7.0

6.8.0

6.9.0

6.9.1

6.10.0

6.11.0

6.12.0

6.13.0

6.14.0

6.15.0

6.16.0

6.17.0

6.18.0

6.19.0

6.20.0

6.21.0

6.22.0

6.23.0

6.24.0

6.25.0

6.26.0

6.27.0

6.27.1

6.28.0

6.29.0

6.30.0

7.*

7.0.0-M1

7.0.0-M2

7.0.0-M3

7.0.0-M4

7.0.0-M5

7.0.0-M6

7.0.0

7.1.0

7.2.0

7.3.0

7.4.0

7.5.0

7.6.0

7.7.0

7.8.0

7.9.0

7.10.0

7.11.0

7.12.0

7.13.0

7.14.0

7.15.0

7.16.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.9.0

Affected versions

8.*

8.0.0

8.1.0

8.2.0

8.3.0

8.4.0

8.5.0

8.6.0

8.6.1

8.7.0

8.8.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-M1

Fixed

9.0.0

Affected versions

9.*

9.0.0-M1

9.0.0-M2

9.0.0-M3

9.0.0-M4

9.0.0-M5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-M2

Fixed

9.0.0

Affected versions

9.*

9.0.0-M2

9.0.0-M3

9.0.0-M4

9.0.0-M5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-M3

Fixed

9.0.0

Affected versions

9.*

9.0.0-M3

9.0.0-M4

9.0.0-M5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-M4

Fixed

9.0.0

Affected versions

9.*

9.0.0-M4

9.0.0-M5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"

org.apache.wicket:wicket-core

Package

Name: org.apache.wicket:wicket-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.wicket/wicket-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-M5

Fixed

9.0.0

Affected versions

9.*

9.0.0-M5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json"