CVE-2020-9311

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login usually CMS access can craft profile information which can lead to XSS for other users through specially crafted login form URLs...

2FA bypass through deleting devices in wagtail-2fa

Impact Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the...

Unspecified vulnerability in wagtail-2fa

wagtail-2fa is a two-factor authentication software package. A security vulnerability exists in versions prior to wagtail-2fa 1.3.0 that can be exploited by an attacker to log in to CMS and bypass the 2FA check, in order to add new devices and gain full access to CMS...

PYSEC-2019-65

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-135

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

2FA bypass in Wagtail through new device path

2FA bypass through new device path Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. Patches This problem has been patched in version 1.3.0...

PT-2019-14822

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.3.0 Description The issue allows an attacker to bypass the 2FA check by changing the URL after gaining access to someone's Wagtail login credentials. They can then add a new device and gain full access to the CM...