Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlnanYtNnFxNi12N3Ft

2FA bypass through deleting devices in wagtail-2fa

Impact

Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the account if they figure out their password.

Patches

The problem has been patched in version 1.4.1.

Workarounds

There is no workaround for this issue.

For more information

If you have any questions or comments about this advisory:

• Open an issue in github.com/labd/wagtail-2fa
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-9gjv-6qq6-v7qm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlnanYtNnFxNi12N3Ft
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 5 years ago
Updated: 3 months ago

CVSS Score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

EPSS Percentage: 0.0005
EPSS Percentile: 0.21514

Identifiers: GHSA-9gjv-6qq6-v7qm, CVE-2020-5240
References:

• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
• https://nvd.nist.gov/vuln/detail/CVE-2020-5240
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2020-219.yaml
• https://github.com/advisories/GHSA-9gjv-6qq6-v7qm

Repository: https://github.com/labd/wagtail-2fa
Blast Radius: 8.2

Affected Packages