CVE-2020-11001CWE-79CWE-80

Possible XSS attack in Wagtail

Medium · published April 14, 2020

CVSS v3.1
5.8
EPSS
1%
Percentile
69.7
In the wild
Unconfirmed
What it is

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision

comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail

admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform

actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to

the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01273 · 69.7th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2020-04-14T23:05Z
EPSS history
Timeline
  • 14 APR 23:05Z
    Possible XSS attack in Wagtail
    cvelistv5