~ / search / GHSA-64gv-3pqv-299h

GHSA-64gv-3pqv-299h

Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket

Source: GitHub Advisory Database (reviewed) High CVE-2020-11976

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.wicket:wicket-core < 7.17.0 7.17.0
Maven org.apache.wicket:wicket-core >= 8.0.0, < 8.9.0 8.9.0
Maven org.apache.wicket:wicket-core >= 9.0.0-M1, < 9.0.0 9.0.0
Maven org.apache.wicket:wicket-core >= 9.0.0-M2, < 9.0.0 9.0.0
Maven org.apache.wicket:wicket-core >= 9.0.0-M3, < 9.0.0 9.0.0
Maven org.apache.wicket:wicket-core >= 9.0.0-M4, < 9.0.0 9.0.0
Maven org.apache.wicket:wicket-core >= 9.0.0-M5, < 9.0.0 9.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

References

External links from the advisory. They lead to third-party sites.