377 matches found
Authorization Bypass
Wagtail is vulnerable to Authorization Bypass. The vulnerability is due to inadequate checks in the ModelViewSet and wagtail.contrib.settings modules, allowing users with general edit permissions to update fields they are otherwise restricted from accessing via crafted HTTP POST requests...
CVE-2024-32882
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...
CVE-2024-32882
CVE-2024-32882 affects Wagtail. In affected versions, if a model is editable via wagtail.contrib.settings or ModelViewSet and a field is restricted with the FieldPanel.permission setting, a user who has edit permission on the model but not on the specific field can craft an HTTP POST that bypasse...
CVE-2024-32882 Permission check bypass when editing a model with per-field restrictions in wagtail
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...
CVE-2024-32882 Permission check bypass when editing a model with per-field restrictions in wagtail
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...
CVE-2024-32882 Permission check bypass when editing a model with per-field restrictions in wagtail
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...
Wagtail 安全漏洞
Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Wagtail versions 6.0 through 6.0.2, which stems from a vulnerability that allows an attacker to bypass privilege checking via wagtail.contrib.settings, ModelViewSet...
GHSA-W2V8-PHP4-P8HC Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
Impact If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific...
Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
Impact If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific...
PT-2024-24938
Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.0.3 and 6.1 Description In affected versions, if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to...
Information Disclosure
wagtail is vulnerable to Information Disclosure. The vulnerability allows an authenticated admin attacker to obtain the display names of user accounts by making a direct URL request to the admin view that handles bulk actions on user accounts...
Path Traversal
coderedcms is vulnerable to Path Traversal. An attacker could exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable Wagtail CRX CodeRed Extensions server. The request would contain a specially crafted path that would cause the server to serve the attacker a file...
GHSA-H454-RQ3M-89RC Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
CVE-2021-46897
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
CVE-2021-46897
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
Path traversal
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
PYSEC-2023-210
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
