High severity · published Mar 13, 2020
CVE-2020-5240
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path
8.5
CVSS
1%
EPSS
No
On KEV
Description
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wagtail-2fa · Labdigital
before 1.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5240
Patch
https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
Third Party Advisory
https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
More from Wagtail-2fa
8.8
CVE-2019-16766
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL