Vulnerabilities > CVE-2020-11976 - Files or Directories Accessible to External Parties vulnerability in Apache Fortress and Wicket

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

apache

CWE-552

NVD

Published: 2020-08-11

Updated: 2024-11-21

Summary

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Wicket 9.0.0 Apache Wicket 0.9.11 Apache Wicket 0.9.13 Apache Wicket 0.9.14 Apache Wicket 0.9.15 Apache Wicket 0.9.16 Apache Wicket 0.9.17 Apache Wicket 0.9.18 Apache Wicket 0.9.19 Apache Wicket 1.0 Apache Wicket 1.0.1 Apache Wicket 1.0.2 Apache Wicket 1.0.3 Apache Wicket 1.1 Apache Wicket 1.1.1 Apache Wicket 1.2 Apache Wicket 1.2.2 Apache Wicket 1.2.3 Apache Wicket 1.2.4 Apache Wicket 1.2.5 Apache Wicket 1.2.6 Apache Wicket 1.2.7 Apache Wicket 1.3.0 Apache Wicket 1.3.1 Apache Wicket 1.3.2 Apache Wicket 1.3.3 Apache Wicket 1.3.4 Apache Wicket 1.3.5 Apache Wicket 1.3.6 Apache Wicket 1.3.7 Apache Wicket 1.4 Apache Wicket 1.4.0 Apache Wicket 1.4.1 Apache Wicket 1.4.2 Apache Wicket 1.4.3 Apache Wicket 1.4.4 Apache Wicket 1.4.5 Apache Wicket 1.4.6 Apache Wicket 1.4.7 Apache Wicket 1.4.8 Apache Wicket 1.4.9 Apache Wicket 1.4.10 Apache Wicket 1.4.11 Apache Wicket 1.4.12 Apache Wicket 1.4.13 Apache Wicket 1.4.14 Apache Wicket 1.4.15 Apache Wicket 1.4.16 Apache Wicket 1.4.17 Apache Wicket 1.4.18 Apache Wicket 1.4.19 Apache Wicket 1.4.20 Apache Wicket 1.4.21 Apache Wicket 1.4.23 Apache Wicket 1.5 Apache Wicket 1.5.0 Apache Wicket 1.5.1 Apache Wicket 1.5.2 Apache Wicket 1.5.3 Apache Wicket 1.5.4 Apache Wicket 1.5.4.1 Apache Wicket 1.5.5 Apache Wicket 1.5.6 Apache Wicket 1.5.7 Apache Wicket 1.5.8 Apache Wicket 1.5.9 Apache Wicket 1.5.10 Apache Wicket 1.5.11 Apache Wicket 1.5.12 Apache Wicket 1.5.13 Apache Wicket 1.5.14 Apache Wicket 1.5.15 Apache Wicket 1.5.16 Apache Wicket 1.5.17 Apache Wicket 6.0.0 Apache Wicket 6.0.0-Beta1 Apache Wicket 6.0.0-Beta2 Apache Wicket 6.0.0-Beta3 Apache Wicket 6.1.0 Apache Wicket 6.1.1 Apache Wicket 6.2.0 Apache Wicket 6.3.0 Apache Wicket 6.4.0 Apache Wicket 6.5.0 Apache Wicket 6.6.0 Apache Wicket 6.7.0 Apache Wicket 6.8.0 Apache Wicket 6.9.0 Apache Wicket 6.9.1 Apache Wicket 6.10.0 Apache Wicket 6.11.0 Apache Wicket 6.12.0 Apache Wicket 6.13.0 Apache Wicket 6.14.0 Apache Wicket 6.15.0 Apache Wicket 6.16.0 Apache Wicket 6.17.0 Apache Wicket 6.18.0 Apache Wicket 6.19.0 Apache Wicket 6.20.0 Apache Wicket 6.21.0 Apache Wicket 6.22.0 Apache Wicket 6.23.0 Apache Wicket 6.24.0 Apache Wicket 6.25.0 Apache Wicket 6.26.0 Apache Wicket 6.27.0 Apache Wicket 6.27.1 Apache Wicket 6.28.0 Apache Wicket 6.29.0 Apache Wicket 6.30.0 Apache Wicket 7.0 Apache Wicket 7.0.0 Apache Wicket 7.1.0 Apache Wicket 7.2.0 Apache Wicket 7.3.0 Apache Wicket 7.4.0 Apache Wicket 7.5.0 Apache Wicket 7.6.0 Apache Wicket 7.7.0 Apache Wicket 7.8.0 Apache Wicket 7.9.0 Apache Wicket 7.10.0 Apache Wicket 7.11.0 Apache Wicket 7.12.0 Apache Wicket 7.13.0 Apache Wicket 7.14.0 Apache Wicket 7.16.0 Apache Wicket 8.0.0 Apache Wicket 8.1.0 Apache Wicket 8.2.0 Apache Wicket 8.3.0 Apache Wicket 8.4.0 Apache Wicket 8.5.0 Apache Wicket 8.8.0 Apache Fortress 2.0.5	213

Common Weakness Enumeration (CWE)

CWE-552 - Files or Directories Accessible to External Parties

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References