| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.wicket:wicket-core | ≥ 8.0.0, < 8.9.0≥ 9.0.0-M1, < 9.0.0≥ 9.0.0-M2, < 9.0.0≥ 9.0.0-M3, < 9.0.0≥ 9.0.0-M4, < 9.0.0≥ 9.0.0-M5, < 9.0.0< 7.17.0 | 8.9.09.0.07.17.0 |
| fortress | = 2.0.5 | |
| wicket | = 9.0.0≥ 8.0.0, < 8.9.0< 7.17.0 | 8.9.07.17.0 |
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free