pysec - pysec-2020-219

pysec-2020-219

Vulnerability from pysec

Published

2020-03-13 22:15

Modified

2021-08-25 04:30

Details

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.

Impacted products

Name	purl
wagtail-2fa	pkg:pypi/wagtail-2fa

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail-2fa",
        "purl": "pkg:pypi/wagtail-2fa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "ac23550d33b7436e90e3beea904647907eba5b74"
            }
          ],
          "repo": "https://github.com/labd/wagtail-2fa",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.1.0",
        "1.0.0",
        "1.0.1",
        "1.1.0",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5240",
    "GHSA-9gjv-6qq6-v7qm"
  ],
  "details": "In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.",
  "id": "PYSEC-2020-219",
  "modified": "2021-08-25T04:30:36.375287Z",
  "published": "2020-03-13T22:15:00Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"
    }
  ]
}

CVE-2020-5240 (GCVE-0-2020-5240)

Vulnerability from cvelistv5

Published

2020-03-13 21:20

Modified

2024-08-04 08:22

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

CWE

CWE-285 - Improper Authorization

Summary

References

►

URL

Tags

	https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm	x_refsource_CONFIRM
	https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Lab Digital	wagtail-2fa	Version: < 1.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:09.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wagtail-2fa",
          "vendor": "Lab Digital",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-13T21:20:14",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"
        }
      ],
      "source": {
        "advisory": "GHSA-9gjv-6qq6-v7qm",
        "discovery": "UNKNOWN"
      },
      "title": "2FA bypass through deleting devices in wagtail-2fa",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5240",
          "STATE": "PUBLIC",
          "TITLE": "2FA bypass through deleting devices in wagtail-2fa"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "wagtail-2fa",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lab Digital"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm",
              "refsource": "CONFIRM",
              "url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"
            },
            {
              "name": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74",
              "refsource": "MISC",
              "url": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-9gjv-6qq6-v7qm",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5240",
    "datePublished": "2020-03-13T21:20:14",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:09.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-9gjv-6qq6-v7qm

Vulnerability from github

Published

2020-03-13 21:18

Modified

2024-11-19 15:35

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
6.2 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Summary

2FA bypass through deleting devices in wagtail-2fa

Details

Impact

Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the account if they figure out their password.

Patches

The problem has been patched in version 1.4.1.

Workarounds

There is no workaround for this issue.

For more information

If you have any questions or comments about this advisory: * Open an issue in github.com/labd/wagtail-2fa * Email us at security@labdigital.nl

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail-2fa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5240"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-03-13T21:18:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nAny user with access to the CMS can view and delete other users\u0026#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user\u0026#39;s device they can disable the target user\u0026#39;s 2FA devices and potentially compromise the account if they figure out their password.\n\n### Patches\nThe problem has been patched in version 1.4.1.\n\n### Workarounds\nThere is no workaround for this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)\n* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)",
  "id": "GHSA-9gjv-6qq6-v7qm",
  "modified": "2024-11-19T15:35:10Z",
  "published": "2020-03-13T21:18:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5240"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/labd/wagtail-2fa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2020-219.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "2FA bypass through deleting devices in wagtail-2fa"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2020-219

Vulnerability from pysec

CVE-2020-5240 (GCVE-0-2020-5240)

Vulnerability from cvelistv5

ghsa-9gjv-6qq6-v7qm

Vulnerability from github

Impact

Patches

Workarounds

For more information

Tags

Sightings

Nomenclature