PT-2020-12963 · Apache · Apache Wicket

Shawn Mckinney

·

Published

2020-08-11

·

Updated

2022-04-26

·

CVE-2020-11976

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Description The issue allows an attacker to obtain unprocessed HTML templates by crafting a special URL, potentially exposing sensitive information that is usually removed during rendering.
Recommendations For Apache Wicket version 7.16.0, update to a version that includes the fix for this issue. For Apache Wicket version 8.8.0, update to a version that includes the fix for this issue. For Apache Wicket version 9.0.0-M5, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive HTML templates until a patch is available.

Fix

Files Accessible to External Parties

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-552CWE-200

Related Identifiers

CVE-2020-11976
GHSA-64GV-3PQV-299H

Affected Products

Apache Wicket