Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
CVE-2021-29434

6.1MEDIUM

Key Information:

Vendor

Wagtail

Status
Wagtail
Vendor
CVE Published:
19 April 2021

What is CVE-2021-29434?

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).

Affected Version(s)

wagtail <= 2.11.6 <= 2.11.6

wagtail >= 2.12, <= 2.12.3 <= 2.12, 2.12.3

References

https://github.com/wagtail/wagtail/security/advisories/GH...
x_refsource_CONFIRM
https://pypi.org/project/wagtail/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.