PT-2024-24938 · Wagtail · Wagtail

Jams2 + 1 · Published 2024-05-01 · Updated 2024-05-02 · CVE-2024-32882

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.0.3 and 6.1

Description In affected versions, if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This issue is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected.

Recommendations For versions prior to 6.0.3 and 6.1, upgrade to a patched version. As a temporary workaround, for models registered through ModelViewSet, register the model as a snippet instead. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-280

CWE-281

Related Identifiers

CVE-2024-32882

GHSA-W2V8-PHP4-P8HC

Affected Products

Wagtail

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32882.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32882 · Security Note
• https://osv.dev/vulnerability/GHSA-w2v8-php4-p8hc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32882 · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc · Note
• https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b · Note
• https://github.com/wagtail/wagtail/commit/fa0d4829f9c81eefb37cc058e2fa1b6a918741da · Note
• https://github.com/wagtail/wagtail/releases/tag/v6.0.3 · Note
• https://twitter.com/VulmonFeeds/status/1785982951995367813 · Twitter Post
• https://docs.wagtail.org/en/stable/reference/contrib/settings.html · Note
• https://t.me/cvenotify/78835 · Telegram Post
• https://t.me/cvenotify/78808 · Telegram Post
• https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset · Note
• https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission · Note