CVE-2020-11976
- State
- Published
- Severity
- Not scored
- Published
- Aug 11, 2020
- Updated
- Aug 4, 2024
- Reserved
- Apr 21, 2020
Description
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache Wicketn/a |
|
References
- https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E
- [directory-commits] 20210513 [directory-fortress-commander] branch master updated: FC-293 - CVE-2020-11976 - upgrade wicket core -> 8.9.0mailing-list
- [directory-dev] 20210513 [jira] [Created] (FC-293) [fortress-web] CVE-2020-11976mailing-list
- [directory-dev] 20210514 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976mailing-list
- [directory-dev] 20210626 [jira] [Updated] (FC-293) [fortress-web] CVE-2020-11976mailing-list
- [directory-dev] 20210626 [jira] [Resolved] (FC-293) [fortress-web] CVE-2020-11976mailing-list
- [directory-dev] 20210626 [jira] [Closed] (FC-293) [fortress-web] CVE-2020-11976mailing-list
- [directory-dev] 20210626 [jira] [Reopened] (FC-293) [fortress-web] CVE-2020-11976mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.