wagtail prior 6.0.5/6.1.2 wagtail.contrib.settings insufficient permissions or privileges

Summaryinfo

A vulnerability classified as problematic has been found in wagtail. This affects an unknown part of the component wagtail.contrib.settings. The manipulation leads to insufficient permissions or privileges. This vulnerability is documented as CVE-2024-35228. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in wagtail. It has been rated as problematic. This issue affects some unknown processing of the component wagtail.contrib.settings. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. Using CWE to declare the problem leads to CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability in `ModelViewSet` by registering the model as a snippet instead. No workaround is available for `wagtail.contrib.settings`.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-35228 since 05/14/2024. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 6.0.5 or 6.1.2 eliminates this vulnerability. Applying the patch 284f75a6f91f7ab18cc304d7d34f33b559ae37b1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• wagtail

License

• open-source

Website

• Product: https://github.com/wagtail/wagtail/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion