Threats tagged 'ghsa-3hjq-2xr3-p7px'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 have a vulnerability where developer-authored component markup template files can be accessed by external parties under certain class loader configurations. This occurs when wicket-core is loaded by a class loader that cannot see the application's component classes, causing the framework to incorrectly serve component markup templates as static resources. The exposure is read-only and limited to markup content, without access to user data or credentials. The issue is fixed in versions 8.20.0, 9.25.0, and 10.12.0.