PT-2019-20152 · Wagtail · Wagtail-2Fa

Publicado 2019-11-29 · Atualizado 2019-11-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.3.0

Description The issue allows an attacker to bypass the 2-factor authentication (2FA) check in the Wagtail CMS by manipulating the URL, potentially gaining full access to the system if they have obtained a user's login credentials. This can be exploited to add a new device to the account, further compromising security.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue.

Identificadores relacionados

PYSEC-2019-65

Produtos afetados

Wagtail-2Fa

Referências · 4

• https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm · Nota
• https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca · Nota
• https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-65 · Aviso do Fabricante