CVE-2020-11001
Description
In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wagtailPyPI | >= 1.9.0, < 2.7.2 | 2.7.2 |
wagtailPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
Affected products
4Patches
Vulnerability mechanics
References
6- github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-v2wc-pfq2-5cm6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-11001ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-152.yamlghsaWEB
- github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389nvdWEB
- github.com/wagtail/wagtail/releases/tag/v2.8.1nvdWEB
News mentions
0No linked articles in our index yet.