Description
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Apache Wicket | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2021-0965 | By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5 |
 Github GHSA |
GHSA-64gv-3pqv-299h | Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2024-08-04T11:48:57.562Z
Reserved: 2020-04-21T00:00:00.000Z
Link: CVE-2020-11976
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-08-11T19:15:17.220
Modified: 2024-11-21T04:59:01.770
Link: CVE-2020-11976
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses