CVE-2020-11001

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

CVSS v3 6.8 MEDIUM
CVSS v2.0 3.5 LOW

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389	Patch Third Party Advisory
https://github.com/wagtail/wagtail/releases/tag/v2.8.1	Release Notes Third Party Advisory
https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:torchbox:wagtail::::::::
	cpe:2.3:a:torchbox:wagtail:2.8:::::::*

History

No history.

Information

Published : 2020-04-14 23:15

Updated : 2020-04-15 19:15

NVD link : CVE-2020-11001

Mitre link : CVE-2020-11001

CVE.ORG link : CVE-2020-11001

JSON object : View

Products Affected

torchbox

wagtail

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2020-11001", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.3}]}, "published": "2020-04-14T23:15:11.917", "references": [{"url": "https://github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wagtail/wagtail/releases/tag/v2.8.1", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch)."}, {"lang": "es", "value": "En Wagtail versiones anteriores a 2.8.1 y 2.7.2, se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en la vista de comparaci\u00f3n de la revisi\u00f3n de p\u00e1gina dentro de la interfaz de administraci\u00f3n de Wagtail. Un usuario con una cuenta editor con permisos limitados para el administrador de Wagtail podr\u00eda crear un historial de revisi\u00f3n de la p\u00e1gina que, cuando la visualice un usuario con m\u00e1s altos privilegios, podr\u00eda llevar a cabo acciones con las credenciales de ese usuario. La vulnerabilidad no es explotable por un visitante ordinario del sitio sin acceso al administrador de Wagtail. Las versiones parcheadas han sido publicadas como Wagtail versi\u00f3n 2.7.2 (para la rama LTS versi\u00f3n 2.7) y Wagtail versi\u00f3n 2.8.1 (para la rama actual 2.8)."}], "lastModified": "2020-04-15T19:15:41.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B846C075-8189-4C8F-BDF3-A6C88AF3C19B", "versionEndIncluding": "2.7.1", "versionStartIncluding": "1.9"}, {"criteria": "cpe:2.3:a:torchbox:wagtail:2.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99FC794D-1CE6-4E31-A5F2-67767286E9DE"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}