CVE-2020-11976
Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
CVE-2020-11976- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
CVE List No score
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
CVE-2020-11976- Updated
- 2026-11-02
EUVDEUVD-2021-0965 No score
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
EUVD-2021-0965- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-64gv-3pqv-299h
Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
GHSA-64gv-3pqv-299h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-552
- Updated
- 2026-11-02
OSV
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
CVE-2020-11976- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-64gv-3pqv-299h
Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Record
GHSA-64gv-3pqv-299h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-552
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.wicket:wicket-coreMaven |
before 7.17.0 | 7.17.0 |
org.apache.wicket:wicket-coreMaven |
8.0.0 up to 8.9.0 | 8.9.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M1 to 9.0.0-M1 | 9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M2 to 9.0.0-M2 | 9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M3 to 9.0.0-M3 | 9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M4 to 9.0.0-M4 | 9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M5 to 9.0.0-M5 | 9.0.0 |
org.apache.wicket:wicket-coreMaven |
before 7.17.0, plus listed versions 1.5-RC11.5-RC31.5-RC4.21.5-RC5.11.5-RC7 Show 45 moreShow less1.5-rc21.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.96.0.06.0.0-beta16.0.0-beta26.0.0-beta36.1.06.1.16.10.06.11.06.12.06.13.06.14.06.15.06.16.06.17.06.18.06.19.06.2.06.20.06.21.06.22.06.23.06.24.06.25.06.26.06.27.06.27.1 |
7.17.0 |
org.apache.wicket:wicket-coreMaven |
8.0.0 up to 8.9.0, plus listed versions 8.1.08.2.08.3.08.4.08.5.0 Show 4 moreShow less8.6.08.6.18.7.08.8.0 |
8.9.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M1 up to 9.0.0, plus listed versions 9.0.0-M29.0.0-M39.0.0-M49.0.0-M5 |
9.0.0 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.wicket:wicket-coreMaven |
9.0.0-M2 up to 9.0.0, plus listed versions 9.0.0-M39.0.0-M49.0.0-M5 |
9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M3 up to 9.0.0, plus listed versions 9.0.0-M49.0.0-M5 |
9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M4 up to 9.0.0, plus listed versions 9.0.0-M5 |
9.0.0 |
org.apache.wicket:wicket-coreMaven |
9.0.0-M5 up to 9.0.0 | 9.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11976 is a high vulnerability (CVSS 7.5) in Apache Wicket, published August 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.76%, the 89th percentile. Fixed in org.apache.wicket:wicket-core 7.17.0.
References
lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-11976
github.com/advisories/GHSA-64gv-3pqv-299h
Left out here: 34 versions. The JSON record has them.