High severity · published Nov 29, 2019
CVE-2019-16766
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wagtail-2fa · Labdigital
before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16766
Third Party Advisory
https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm
Patch
https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca
Patch
https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81
More from Wagtail-2fa
8.5
CVE-2020-5240
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path