PT-2020-12505 · Wagtail · Wagtail
Thibaud Colas
·
Published
2020-04-30
·
Updated
2024-11-19
·
CVE-2020-11037
CVSS v3.1
6.1
Medium
| Vector | AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Wagtail versions prior to 2.7.3
Wagtail versions prior to 2.8.2
Description
A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet. Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this issue.
Recommendations
For versions prior to 2.7.3, update to version 2.7.3 or later to resolve the issue.
For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue.
As a temporary workaround, consider using user- or group-based privacy restrictions to restrict access to sensitive information, as these are unaffected by this issue.
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wagtail