Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket

HIGH 7.5CVE-2020-11976 · GHSA-64gv-3pqv-299h · Published 11/08/2020 · updated 17/06/2026

In short

CVE-2020-11976 is a HIGH (CVSS 7.5) vulnerability affecting org.apache.wicket:wicket-core, fortress (apache), wicket (apache).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 89.9% of all vulnerabilities.
Fix: update to 8.9.0, 9.0.0, 7.17.0 or later.

Package	Affected versions	Patched versions
org.apache.wicket:wicket-core Maven	`≥ 8.0.0, < 8.9.0≥ 9.0.0-M1, < 9.0.0≥ 9.0.0-M2, < 9.0.0≥ 9.0.0-M3, < 9.0.0≥ 9.0.0-M4, < 9.0.0≥ 9.0.0-M5, < 9.0.0< 7.17.0`	`8.9.09.0.07.17.0`
fortress apache	`= 2.0.5`	No fix yet
wicket apache	`= 9.0.0≥ 8.0.0, < 8.9.0< 7.17.0`	`8.9.07.17.0`

Description

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

NVD description

References

More vulnerabilities in org.apache.wicket:wicket-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free