id: PYSEC-2020-152
details: In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS)
  vulnerability exists on the page revision comparison view within the Wagtail admin
  interface. A user with a limited-permission editor account for the Wagtail admin
  could potentially craft a page revision history that, when viewed by a user with
  higher privileges, could perform actions with that user's credentials. The vulnerability
  is not exploitable by an ordinary site visitor without access to the Wagtail admin.
  Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and
  Wagtail 2.8.1 (for the current 2.8 branch).
affected:
- package:
    name: wagtail
    ecosystem: PyPI
    purl: pkg:pypi/wagtail
  ranges:
  - type: GIT
    repo: https://github.com/wagtail/wagtail
    events:
    - introduced: "0"
    - fixed: 61045ceefea114c40ac4b680af58990dbe732389
  - type: ECOSYSTEM
    events:
    - introduced: "1.9"
    - fixed: 2.7.2
  versions:
  - "1.9"
  - 1.9.1
  - 1.10rc1
  - "1.10"
  - 1.10.1
  - 1.11rc1
  - "1.11"
  - 1.11.1
  - 1.12rc1
  - "1.12"
  - 1.12.1
  - 1.12.2
  - 1.12.3
  - 1.12.4
  - 1.12.5
  - 1.12.6
  - 1.13rc1
  - "1.13"
  - 1.13.1
  - 1.13.2
  - 1.13.3
  - 1.13.4
  - 2.0b1
  - 2.0rc1
  - "2.0"
  - 2.0.1
  - 2.0.2
  - 2.1rc1
  - 2.1rc2
  - "2.1"
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.2rc1
  - 2.2rc2
  - "2.2"
  - 2.2.1
  - 2.2.2
  - 2.3rc1
  - 2.3rc2
  - "2.3"
  - 2.4rc1
  - "2.4"
  - 2.5rc1
  - "2.5"
  - 2.5.1
  - 2.5.2
  - 2.6rc1
  - "2.6"
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7rc1
  - 2.7rc2
  - "2.7"
  - 2.7.1
references:
- type: ADVISORY
  url: https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6
- type: WEB
  url: https://github.com/wagtail/wagtail/releases/tag/v2.8.1
- type: FIX
  url: https://github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389
aliases:
- CVE-2020-11001
- GHSA-v2wc-pfq2-5cm6
modified: "2020-04-15T19:15:00Z"
published: "2020-04-14T23:15:00Z"