PT-2021-19853 · Wagtail · Wagtail
Karen Tracey
·
Published
2021-06-17
·
Updated
2021-06-23
·
CVE-2021-32681
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Wagtail versions 2.13 through 2.13.1
Wagtail versions 2.12 through 2.12.4
Wagtail versions prior to 2.11.8
Description
A cross-site scripting issue exists when the
{% include block %} template tag is used to output the value of a plain-text StreamField block, such as CharBlock or TextBlock, without a specified template for rendering. This could allow users to insert arbitrary HTML or scripting, but it is only exploitable by users with 'editor' access to the Wagtail admin.Recommendations
For Wagtail versions 2.13 through 2.13.1, update to version 2.13.2.
For Wagtail versions 2.12 through 2.12.4, update to version 2.12.5.
For Wagtail versions prior to 2.11.8, update to version 2.11.8.
As a temporary workaround for sites unable to upgrade, audit the use of
{% include block %} to ensure it is not used to output CharBlock / TextBlock values with no associated template, and consider replacing the tag with Django's {{ ... }} syntax.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wagtail