p PatchFirst

CVE-2020-11001

CVE-2020-11001 · Possible XSS attack in Wagtail

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

CVSS 5.8 · Media · EPSS 1,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • wagtail

    Versiones
    • < 2.7.2: Afectada
    • >= 2.8.0, < 2.8.1: Afectada

    Sin corrección publicada

  • wagtail PyPI

    Versiones
    • 1.10
    • 1.10.1
    • 1.10rc1
    • 1.11
    • 1.11.1
    • 1.11rc1
    • 1.12
    • 1.12.1
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.12.5
    • 1.12.6
    • 1.12rc1
    • 1.13
    • 1.13.1
    • 1.13.2
    • 1.13.3
    • 1.13.4
    • 1.13rc1
    • 1.9
    • 1.9.1
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.0b1
    • 2.0rc1
    • 2.1
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1rc1
    • 2.1rc2
    • 2.2
    • 2.2.1
    • 2.2.2
    • 2.2rc1
    • 2.2rc2
    • 2.3
    • 2.3rc1
    • 2.3rc2
    • 2.4
    • 2.4rc1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.5rc1
    • 2.6
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6rc1
    • 2.7
    • 2.7.1
    • 2.7rc1
    • 2.7rc2
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.9.0, < 2.7.2

    Actualiza a 2.7.2

  • wagtail PyPI

    Versiones
    • 2.8
    • 2.8.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 2.8.0, < 2.8.1

    Actualiza a 2.8.1

  • wagtail PyPI

    Versiones
    • 1.9
    • 1.9.1
    • 1.10rc1
    • 1.10
    • 1.10.1
    • 1.11rc1
    • 1.11
    • 1.11.1
    • 1.12rc1
    • 1.12
    • 1.12.1
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.12.5
    • 1.12.6
    • 1.13rc1
    • 1.13
    • 1.13.1
    • 1.13.2
    • 1.13.3
    • 1.13.4
    • 2.0b1
    • 2.0rc1
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.1rc1
    • 2.1rc2
    • 2.1
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2rc1
    • 2.2rc2
    • 2.2
    • 2.2.1
    • 2.2.2
    • 2.3rc1
    • 2.3rc2
    • 2.3
    • 2.4rc1
    • 2.4
    • 2.5rc1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.6rc1
    • 2.6
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.7rc1
    • 2.7rc2
    • 2.7
    • 2.7.1
    Intervalos de versiones afectados
    • GIT: < 61045ceefea114c40ac4b680af58990dbe732389
    • ECOSYSTEM: ≥ 1.9, < 2.7.2

    Actualiza a 2.7.2

Fuentes originales

Comprueba tu servidor →