CVE-2021-29434
CVSS V2 Low 3.5
CVSS V3 Medium 4.8
Description
Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).
Overview
- CVE ID
- CVE-2021-29434
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-04-19T19:15:17
- Last Modified Date
- 2021-04-29T14:24:41
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:torchbox:wagtail:*:*:*:*:-:*:*:* | 1 | OR | 2.11.6 | |
cpe:2.3:a:torchbox:wagtail:*:*:*:*:lts:*:*:* | 1 | OR | 2.11.0 | 2.11.7 |
cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:* | 1 | OR | 2.12.0 | 2.12.4 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:S/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- SINGLE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 3.5
- Severity
- LOW
- Exploitability Score
- 6.8
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- HIGH
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 4.8
- Base Severity
- MEDIUM
- Exploitability Score
- 1.7
- Impact Score
- 2.7
References
Reference URL | Reference Tags |
---|---|
https://github.com/wagtail/wagtail/security/advisories/GHSA-wq5h-f9p5-q7fx | Mitigation Third Party Advisory |
https://pypi.org/project/wagtail/ | Product Third Party Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-29434 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29434 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 07:13:47 | Added to TrackCVE | |||
2022-12-06 02:06:39 | 2021-04-19T19:15Z | 2021-04-19T19:15:17 | CVE Published Date | updated |
2022-12-06 02:06:39 | 2021-04-29T14:24:41 | CVE Modified Date | updated | |
2022-12-06 02:06:39 | Analyzed | Vulnerability Status | updated |