Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: Apache Wicket 1.4.22, 1.5.10 and 6.7.0
Description: It is possible to make Wicket deliver the HTML templates in their raw/non-processed form. An attacker could see any sensitive information in the part of the HTML template that is usually ignored during rendering. For example if there is sensitive information before or after the Wicket Panel/Border's markup:
{% highlight xml %} something sensitive here 1 wicket:panel real application code </wicket:panel> something sensitive here 2 {% endhighlight %}
Usually Wicket will render only the “real application code” part but by exploiting this vulnerability an attacker can see also the code with the sensitive information.
The application developers are recommended to upgrade to:
and/or to remove any sensitive information in the HTML templates.
Apache Wicket Team