High
Security advisory
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-11976
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:01 UTC · Revision 1
Source evidence
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
osv:CVE-2020-11976
Complete source record
{
"id": "fab341fda0cc49d8784f01e3ae896d9280a659173404e1922e3bdbfb7dcadac5",
"url": "https://osv.dev/vulnerability/CVE-2020-11976",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-11976",
"summary": "By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5",
"evidence": "osv:CVE-2020-11976",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-11976",
"aliases": [
"CVE-2020-11976",
"GHSA-64gv-3pqv-299h"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/wicket",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2d92f60565fc0c5d5954ce6f313555b596197d6d"
},
{
"introduced": "5e789f1c98f6d57dba17f896c6220b0202af08a9"
},
{
"fixed": "c16442d69a2120a1d7453211bcffd68f56b629d7"
},
{
"introduced": "f911c636696a85fb1b81bdf1319667733c3e69fb"
},
{
"last_affected": "e66ea49163d48852d17435954cc6a61277339553"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.17.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:wicket:9.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone1"
},
{
"last_affected": "9.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:wicket:9.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone2"
},
{
"last_affected": "9.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:wicket:9.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone3"
},
{
"last_affected": "9.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:wicket:9.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone4"
},
{
"last_affected": "9.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:wicket:9.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone5"
},
{
"last_affected": "9.0.0-milestone5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.0.0-milestone1",
"9.0.0-milestone2",
"9.0.0-milestone3",
"9.0.0-milestone4",
"9.0.0-milestone5",
"rel/wicket-9.0.0-M5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11976.json"
}
}
],
"modified": "2026-10-24T10:30:47.499991055Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r05340178680eb6b9d4d40d56b5621dd4ae9715e6f41f12ae2288ec49%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/r982c626dbce5c995223c4a6ddd7685de3592f8d65ba8372da1f3ce19%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/rd0f36b83cc9f28b016ec552f023fb5a59a9ea8db56f2b9dcc6a2f6b7%40%3Ccommits.directory.apache.org%3E",
"https://lists.apache.org/thread.html/rd26cae6e30b205e09e4b511d3d962d4f677c0c604f737997ce1b2f22%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/rdec0a43afdca59c10416889e07267f3d2fdf4ab929a6e22a2659b6ff%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/re4af65851bf69605cfb68be215eba36d4cdc1a90b95fbc894799d923%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/reb7ea8141c713b5b19eaf34c00f43aaebf5a1c116130f763c42bdad1%40%3Cdev.directory.apache.org%3E",
"https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:apache:fortress:2.0.5:*:*:*:*:*:*:*"
],
"vendor_product": "apache:fortress",
"extracted_events": [
{
"range": [
{
"introduced": "2.0.5"
},
{
"last_affected": "2.0.5"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-11976",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436562,
"published_at": "2020-08-11T19:15:17.22+00:00"
}