Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash of denial of service. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents. Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged to add extra protections outside of Wagtail to limit the size of uploaded files.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a
    memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and
    documents, files are loaded into memory during upload for additional processing. A user with access to
    upload images or documents through the Wagtail admin interface could upload a file so large that it
    results in a crash of denial of service. The vulnerability is not exploitable by an ordinary site visitor
    without access to the Wagtail admin. It can only be exploited by admin users with permission to upload
    images or documents. Image uploads are restricted to 10MB by default, however this validation only happens
    on the frontend and on the backend after the vulnerable code. Patched versions have been released as
    Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged
    to add extra protections outside of Wagtail to limit the size of uploaded files. (CVE-2023-28837)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2def7c4b-736f-4754-9f03-236fcb586d91 advisory.

  - Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a     memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and     documents, files are loaded into memory during upload for additional processing. A user with access to     upload images or documents through the Wagtail admin interface could upload a file so large that it     results in a crash of denial of service. The vulnerability is not exploitable by an ordinary site visitor     without access to the Wagtail admin. It can only be exploited by admin users with permission to upload     images or documents. Image uploads are restricted to 10MB by default, however this validation only happens     on the frontend and on the backend after the vulnerable code. Patched versions have been released as     Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged     to add extra protections outside of Wagtail to limit the size of uploaded files. (CVE-2023-28837)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409253	SCA: security update for wagtail (GHSA-33pv-vcgh-jfg9)	Tenable Cloud Security	SCA Checks	medium
409253	SCA: security update for wagtail (GHSA-33pv-vcgh-jfg9)	Tenable Self-Hosted Container Security	SCA Checks	medium
180373	FreeBSD : py-wagtail -- DoS vulnerability (2def7c4b-736f-4754-9f03-236fcb586d91)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-28837

medium

Tenable Plugins

medium

medium

medium