CVE-2020-5240CWE-285

2FA bypass through deleting devices in wagtail-2fa

High · published March 13, 2020

CVSS v3.1
7.6
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00999 · 62.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2020-03-13T21:20Z
EPSS history
Timeline
  • 13 MAR 21:20Z
    2FA bypass through deleting devices in wagtail-2fa
    cvelistv5