GitHub Advisoryadvisory · PyPI

GHSA-9gjv-6qq6-v7qm 2FA bypass through deleting devices in wagtail-2fa

MEDIUM Published 2020-03-13 Modified 2024-11-19 Official page ↗
Aliases
CVE-2020-5240
Ecosystem
PyPI
Packages
wagtail-2fa
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
Weaknesses
CWE-285
Reviewed
2020-03-13

Affected packages

• PyPI wagtail-2fa: < 1.4.1 → fixed in 1.4.1

Description

Impact Any user with access to the CMS can view and delete other users&#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user&#39;s device they can disable the target user&#39;s 2FA devices and potentially compromise the account if they figure out their password. Patches The problem has been patched in version 1.4.1. Workarounds There is no workaround for this issue. For more information If you have any questions or comments about this advisory: • Open an issue in github.com/labd/wagtail-2fa • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-5240 In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References