PT-2023-29699 · Wagtail · Wagtail

Quyenheu · Published 2023-10-19 · Updated 2023-12-28 · CVE-2023-45809

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 4.1.8 Wagtail versions prior to 5.0.5 Wagtail versions prior to 5.1.3

Description A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The issue is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Recommendations For versions prior to 4.1.8, upgrade to Wagtail 4.1.8 (LTS) or later. For versions prior to 5.0.5, upgrade to Wagtail 5.0.5 or later. For versions prior to 5.1.3, upgrade to Wagtail 5.1.3 or later. As a temporary workaround, consider restricting access to the admin view that handles bulk actions on user accounts until a patch is available.

Exploit

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

CWE-425

Related Identifiers

CVE-2023-45809

GHSA-FC75-58R8-RM3H

PYSEC-2023-219

Affected Products

Wagtail

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45809.json · Exploit
• https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b · Patch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45809 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fc75-58r8-rm3h · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/releases/tag/v5.1.3 · Note
• https://github.com/wagtail/wagtail/commit/2231f462c75dfe84307fb40577e8c2109a23b27e · Note
• https://github.com/wagtail/wagtail/releases/tag/v5.0.5 · Note
• https://github.com/wagtail/wagtail/commit/0bacd29473107d9d7f5b723a15a683449679756d · Note
• https://github.com/wagtail/wagtail/releases/tag/v4.1.9 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-219.yaml · Note
• https://t.me/cibsecurity/72599 · Telegram Post