Description
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Wicket | Apache Wicket 7.16.0, 8.8.0, 9.0.0-M5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.wicket:wicket-core | < 7.17.0 | 7.17.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 8.0.0, < 8.9.0 | 8.9.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M1, < 9.0.0 | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M2, < 9.0.0 | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M3, < 9.0.0 | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M4, < 9.0.0 | 9.0.0 | GHSA-64gv-3pqv-299h |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M5, < 9.0.0 | 9.0.0 | GHSA-64gv-3pqv-299h |
References
- https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E
- [directory-commits] 20210513 [directory-fortress-commander] branch master updated: FC-293 - CVE-2020-11976 - upgrade wicket core -> 8.9.0 mailing-list
- [directory-dev] 20210513 [jira] [Created] (FC-293) [fortress-web] CVE-2020-11976 mailing-list
- [directory-dev] 20210514 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976 mailing-list
- [directory-dev] 20210626 [jira] [Updated] (FC-293) [fortress-web] CVE-2020-11976 mailing-list
- [directory-dev] 20210626 [jira] [Resolved] (FC-293) [fortress-web] CVE-2020-11976 mailing-list
- [directory-dev] 20210626 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976 mailing-list
- [directory-dev] 20210626 [jira] [Reopened] (FC-293) [fortress-web] CVE-2020-11976 mailing-list