PT-2024-28441 · Wagtail · Wagtail

Realorangeone · Published 2024-07-11 · Updated 2024-09-19 · CVE-2024-39317

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 5.2.6 Wagtail versions prior to 6.0.6 Wagtail versions prior to 6.1.3

Description A bug in Wagtail's parse query string function would result in it taking a long time to process suitably crafted inputs, leading to a denial of service. This issue can be exploited by any Wagtail admin user in an initial installation, but not by end users. However, if a custom search implementation uses parse query string, it may be exploitable by other users, such as unauthenticated users.

Recommendations For versions prior to 5.2.6, update to version 5.2.6 or later. For versions prior to 6.0.6, update to version 6.0.6 or later. For versions prior to 6.1.3, update to version 6.1.3 or later. As a temporary workaround for site owners who cannot upgrade, limit the length of search terms passed to parse query string to 1000 characters or less. Note that this workaround does not apply to Wagtail admin usage.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-39317

GHSA-JMP3-39VP-FWG8

PYSEC-2024-86

Affected Products

Wagtail

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39317.json · Exploit
• https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2 · Patch
• https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2 · Patch
• https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797 · Patch
• https://osv.dev/vulnerability/GHSA-jmp3-39vp-fwg8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39317 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-86 · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2024-86.yaml · Note
• https://t.me/cvedetector/674 · Telegram Post
• https://t.me/cvenotify/95282 · Telegram Post
• https://twitter.com/CVEnew/status/1811428036752888151 · Twitter Post
• https://t.me/cvenotify/85902 · Telegram Post