PT-2023-29699 · Wagtail · Wagtail
Quyenheu
·
Publicado
2023-10-19
·
Atualizado
2023-12-28
·
CVE-2023-45809
CVSS v3.1
2.7
Baixa
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Wagtail versions prior to 4.1.8
Wagtail versions prior to 5.0.5
Wagtail versions prior to 5.1.3
Description
A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The issue is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Recommendations
For versions prior to 4.1.8, upgrade to Wagtail 4.1.8 (LTS) or later.
For versions prior to 5.0.5, upgrade to Wagtail 5.0.5 or later.
For versions prior to 5.1.3, upgrade to Wagtail 5.1.3 or later.
As a temporary workaround, consider restricting access to the admin view that handles bulk actions on user accounts until a patch is available.
Exploit
Correção
Insertion into Log File
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Wagtail