Vulnerability · Published Mar 13, 2020 · Assigned by GitHub_M
CVE-2020-52402FA bypass through deleting devices in wagtail-2fa
High 7.6
In plain English
A high-severity security flaw in wagtail-2fa from Lab Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | wagtail-2fa | 1.4.1 | GHSA-9gjv-6qq6-v7qm |
| PyPI | wagtail-2fa | 1.4.1 | PYSEC-2020-219 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lab Digital | wagtail-2fa | < 1.4.1 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N