id: PYSEC-2020-219
details: In wagtail-2fa before 1.4.1, any user with access to the CMS can view and
  delete other users 2FA devices by going to the correct path. The user does not require
  special permissions in order to do so. By deleting the other users device they can
  disable the target users 2FA devices and potentially compromise the account if they
  figure out their password. The problem has been patched in version 1.4.1.
affected:
- package:
    name: wagtail-2fa
    ecosystem: PyPI
    purl: pkg:pypi/wagtail-2fa
  ranges:
  - type: GIT
    repo: https://github.com/labd/wagtail-2fa
    events:
    - introduced: "0"
    - fixed: ac23550d33b7436e90e3beea904647907eba5b74
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.4.1
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.1.0
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.4.0
references:
- type: FIX
  url: https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
- type: ADVISORY
  url: https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
aliases:
- CVE-2020-5240
- GHSA-9gjv-6qq6-v7qm
modified: "2021-08-25T04:30:36.375287Z"
published: "2020-03-13T22:15:00Z"