PT-2020-18336

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.4.1 Description The issue allows any user with access to the CMS to view and delete other users' 2FA devices by going to the correct path, without requiring special permissions. By deleting another user's device...

CVE-2020-5240: Improper Authorization

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

Two-Factor Authentication Bypass

wagtail-2fa is vulnerable 2fa bypass. An attacker with knowledge of another user's Wagtail login credentials is able to bypass the 2FA verification by modifying the URL, and subsequently add a new device and gain full access to the CMS...

Unspecified vulnerability in wagtail-2fa

wagtail-2fa is a two-factor authentication software package. A security vulnerability exists in versions prior to wagtail-2fa 1.3.0 that can be exploited by an attacker to log in to CMS and bypass the 2FA check, in order to add new devices and gain full access to CMS...

CVE-2019-16766

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

CVE-2019-16766

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

Design/Logic Flaw

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-135

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-135

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-65

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

GHSA-89PX-WW3J-G2MM 2FA bypass in Wagtail through new device path

2FA bypass through new device path Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. Patches This problem has been patched in version 1.3.0...

2FA bypass in Wagtail through new device path

2FA bypass through new device path Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. Patches This problem has been patched in version 1.3.0...

CVE-2019-16766 2FA bypass in Wagtail through new device path

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

CVE-2019-16766

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

CVE-2019-16766

Summary: CVE-2019-16766 affects the wagtail-2fa package prior to 1.3.0. If an attacker gains a user’s Wagtail credentials, they can bypass the two‑factor check by modifying the URL, then add a new device and gain full CMS access. The issue is resolved in version 1.3.0. Impact details (as describe...

PT-2019-20152

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.3.0 Description The issue allows an attacker to bypass the 2-factor authentication 2FA check in the Wagtail CMS by manipulating the URL, potentially gaining full access to the system if they have obtained a user...

CVE-2019-16766: Missing Critical Step in Authentication

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PT-2019-14822

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.3.0 Description The issue allows an attacker to bypass the 2FA check by changing the URL after gaining access to someone's Wagtail login credentials. They can then add a new device and gain full access to the CM...