Safety vulnerability ID: 38249
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of Wagtail are vulnerable to a potential timing attack on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet.
Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.
Latest version: 6.4.1
A Django content management system.
~~~~~~~~~~~~~~~~~~
* Fix: CVE-2020-11037 - avoid potential timing attack on password-protected private pages (Thibaud Colas)
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application