Vulnerability · Published Aug 11, 2020 · Assigned by apache
CVE-2020-11976
High 7.5
In plain English
A high-severity security flaw in Apache Wicket. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.8%top 10.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.wicket:wicket-core | 7.17.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 8.9.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | 9.0.0 | GHSA-64gv-3pqv-299h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Wicket | Apache Wicket 7.16.0, 8.8.0, 9.0.0-M5 |
References
- https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E x_refsource_MISC
- [directory-commits] 20210513 [directory-fortress-commander] branch master updated: FC-293 - CVE-2020-11976 - upgrade wicket core -> 8.9.0 mailing-list, x_refsource_MLIST
- [directory-dev] 20210513 [jira] [Created] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST
- [directory-dev] 20210514 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST
- [directory-dev] 20210626 [jira] [Updated] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST
- [directory-dev] 20210626 [jira] [Resolved] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST
- [directory-dev] 20210626 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST
- [directory-dev] 20210626 [jira] [Reopened] (FC-293) [fortress-web] CVE-2020-11976 mailing-list, x_refsource_MLIST