GitHub_MCVELIST:CVE-2020-5240CVE-2020-5240 2FA bypass through deleting devices in wagtail-2fa
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
8.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
19.5%
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
CNA Affected
[
{
"product": "wagtail-2fa",
"vendor": "Lab Digital",
"versions": [
{
"status": "affected",
"version": "< 1.4.1"
}
]
}
]Related
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
8.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
19.5%