GHSA-x5cx-w6p2-mxf2: Medium severity pip/wagtail vulnerability
Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.
Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds N/A
Acknowledgements Many thanks to tinyb0y for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtail/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtail/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
wagtail/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
wagtail/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Wagtail deployments are exposed where a CMS user has "add" permission for a snippet model but lacks both "change" and "view" permission for snippets they may target. Such a user can copy an existing snippet they are not authorized to view.
What access does an attacker need?
An attacker needs an authenticated CMS account with "add" permission on the affected snippet model. No "change" or "view" permission is required for the snippet whose contents are disclosed.
Which Wagtail releases contain the fix?
The issue is patched in Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Is there a workaround if upgrading is not immediately possible?
No workaround is listed. Restrict or remove "add" permission for snippet models from users who should not be able to access existing snippet contents until a patched release can be deployed.