2FA bypass through deleting devices in wagtail-2fa

CAO 8.5CVE-2020-5240 · GHSA-9gjv-6qq6-v7qm · PYSEC-2020-219 · Công bố 13/03/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-5240 là lỗ hổng mức CAO (CVSS 8.5) ảnh hưởng wagtail-2fa, wagtail-2fa (labdigital).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.00%, cao hơn 62.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.4.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
wagtail-2fa PyPI	`< 1.4.1`	`1.4.1`
wagtail-2fa labdigital	`< 1.4.1`	`1.4.1`

Mô tả

Impact

Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the account if they figure out their password.

Patches

The problem has been patched in version 1.4.1.

Workarounds

There is no workaround for this issue.

For more information

If you have any questions or comments about this advisory:

Open an issue in github.com/labd/wagtail-2fa
Email us at [email protected]

Mô tả của NVD

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.