GHSA-64gv-3pqv-299h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-64gv-3pqv-299h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64gv-3pqv-299h/GHSA-64gv-3pqv-299h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-64gv-3pqv-299h
- Aliases
- Published
- 2021-05-07T15:54:15Z
- Modified
- 2023-11-08T04:02:08.181705Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
- Details
-
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Database specific
{ "nvd_published_at": "2020-08-11T19:15:00Z", "github_reviewed_at": "2021-05-05T22:31:00Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-200", "CWE-552" ] }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-11976
- https://lists.apache.org/thread.html/r05340178680eb6b9d4d40d56b5621dd4ae9715e6f41f12ae2288ec49@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E
- https://lists.apache.org/thread.html/r982c626dbce5c995223c4a6ddd7685de3592f8d65ba8372da1f3ce19@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/rd0f36b83cc9f28b016ec552f023fb5a59a9ea8db56f2b9dcc6a2f6b7@%3Ccommits.directory.apache.org%3E
- https://lists.apache.org/thread.html/rd26cae6e30b205e09e4b511d3d962d4f677c0c604f737997ce1b2f22@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/rdec0a43afdca59c10416889e07267f3d2fdf4ab929a6e22a2659b6ff@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/re4af65851bf69605cfb68be215eba36d4cdc1a90b95fbc894799d923@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/reb7ea8141c713b5b19eaf34c00f43aaebf5a1c116130f763c42bdad1@%3Cdev.directory.apache.org%3E
Affected packages
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed7.17.0
Affected versions
1.*
1.5-RC1
1.5-rc2
1.5-RC3
1.5-RC4.2
1.5-RC5.1
1.5-RC7
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16
1.5.17
6.*
6.0.0-beta1
6.0.0-beta2
6.0.0-beta3
6.0.0
6.1.0
6.1.1
6.2.0
6.3.0
6.4.0
6.5.0
6.6.0
6.7.0
6.8.0
6.9.0
6.9.1
6.10.0
6.11.0
6.12.0
6.13.0
6.14.0
6.15.0
6.16.0
6.17.0
6.18.0
6.19.0
6.20.0
6.21.0
6.22.0
6.23.0
6.24.0
6.25.0
6.26.0
6.27.0
6.27.1
6.28.0
6.29.0
6.30.0
7.*
7.0.0-M1
7.0.0-M2
7.0.0-M3
7.0.0-M4
7.0.0-M5
7.0.0-M6
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.7.0
7.8.0
7.9.0
7.10.0
7.11.0
7.12.0
7.13.0
7.14.0
7.15.0
7.16.0
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core
Maven / org.apache.wicket:wicket-core
Package
- Name
- org.apache.wicket:wicket-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.wicket/wicket-core