PT-2020-18336 · Wagtail · Wagtail-2Fa

Published 2020-03-13 · Updated 2020-03-18 · CVE-2020-5240

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.4.1

Description The issue allows any user with access to the CMS to view and delete other users' 2FA devices by going to the correct path, without requiring special permissions. By deleting another user's device, an attacker can disable the target user's 2FA devices and potentially compromise the account if they figure out the password.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the CMS to minimize the risk of exploitation.

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2020-5240

GHSA-9GJV-6QQ6-V7QM

PYSEC-2020-219

Affected Products

Wagtail-2Fa

References · 9

• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74 · Patch
• https://osv.dev/vulnerability/PYSEC-2020-219 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5240 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gjv-6qq6-v7qm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5240 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2020-219.yaml · Note
• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm · Note
• https://github.com/labd/wagtail-2fa · Note
• https://t.me/cvenotify/1684 · Telegram Post