In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ). Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that
    have been protected with a shared password through Wagtail's "Privacy" controls. This password check is
    performed through a character-by-character string comparison, and so an attacker who is able to measure
    the time taken by this check to a high degree of accuracy could potentially use timing differences to gain
    knowledge of the password. This is [understood to be feasible on a local network, but not on the public
    internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ). Privacy settings
    that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password)
    are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9. (CVE-2020-11037)

Wagtail release notes :

CVE-2020-11037: Potential timing attack on password-protected private pages

This release addresses a potential timing attack on pages or documents that have been protected with a shared password through Wagtail's 'Privacy' controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. (This is understood to be feasible on a local network, but not on the public internet.)

ID	Name	Product	Family	Severity
423523	SCA: security update for wagtail (GHSA-jjjr-3jcw-f8v6)	Tenable Cloud Security	SCA Checks	medium
423523	SCA: security update for wagtail (GHSA-jjjr-3jcw-f8v6)	Tenable Self-Hosted Container Security	SCA Checks	medium
136387	FreeBSD : Wagtail -- potential timing attack vulnerability (d5fead4f-8efa-11ea-a5c8-08002728f74c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-11037

medium

Tenable Plugins

medium

medium

medium