CVE-2020-11976: Apache Wicket - Exposure of Sensitive Information
Summary
CVE-2020-11976: Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket. Affects org.apache.wicket:wicket-core across 7 version ranges.
< 7.17.0
>= 8.0.0, < 8.9.0
>= 9.0.0-M1, < 9.0.0
>= 9.0.0-M2, < 9.0.0
>= 9.0.0-M3, < 9.0.0
>= 9.0.0-M4, < 9.0.0
>= 9.0.0-M5, < 9.0.0
Fixed in 7.17.0, 8.9.0 or 9.0.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Wicket is a Java web application framework that simplifies the development of dynamic web applications. It provides a component-based programming model, allowing developers to create reusable UI components. The Apache Wicket package 'org.apache.wicket:wicket-core' is affected by a vulnerability that exposes sensitive information to unauthorized actors.
Vulnerability Detail
By crafting a special URL, an attacker can exploit Apache Wicket to deliver unprocessed HTML templates. This allows the attacker to view potentially sensitive information within the HTML template that is usually removed during rendering. The vulnerability affects Apache Wicket versions 7.16.0, 8.8.0, and 9.0.0-M5. The impact of this vulnerability can lead to the exposure of confidential data, compromising the security and privacy of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.17.07.17.0 -
>= 8.0.0, < 8.9.08.9.0 -
>= 9.0.0-M1, < 9.0.09.0.0 -
>= 9.0.0-M2, < 9.0.09.0.0 -
>= 9.0.0-M3, < 9.0.09.0.0 -
>= 9.0.0-M4, < 9.0.09.0.0
Show all 7 release lines
-
>= 9.0.0-M5, < 9.0.09.0.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended fix by upgrading the affected package to a secure version.
Conclusion
The exposure of sensitive information vulnerability in Apache Wicket can lead to the unauthorized access of confidential data. It is recommended to upgrade the 'org.apache.wicket:wicket-core' package to a secure version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.wicket:wicket-core →
FAQ
Apache Wicket is a Java web application framework that simplifies the development of dynamic web applications.
The vulnerability allows unauthorized actors to access sensitive information within HTML templates, potentially exposing confidential data.
The vulnerability affects Apache Wicket versions 7.16.0, 8.8.0, and 9.0.0-M5.
To fix this vulnerability, upgrade the 'org.apache.wicket:wicket-core' package to versions 7.17.0, 8.9.0, or 9.0.0.
No workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by upgrading the affected package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.wicket:wicket-core.
