CVE-2020-5240
Summary
| CVE | CVE-2020-5240 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-03-13 22:15:00 UTC |
|---|
| Updated | 2020-03-18 19:25:00 UTC |
|---|
| Description | In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Prevent unauthorized users managing others' device · labd/wagtail-2fa@ac23550 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| 2FA bypass through deleting devices · Advisory · labd/wagtail-2fa · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 983119 Python (pip) Security Update for wagtail-2fa (GHSA-9gjv-6qq6-v7qm)
