PyPI/wagtail CVE-2023-28836: medium 6.4, EPSS 0.78%
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Action: Upgrade wagtail to 4.1.4 or later.
pip install wagtail==4.1.4pip install wagtail==4.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5 | 4.1.4 | - |
| 4.2 | 4.2.2 | - |
Fixed versions
| 4.1.4 | 4.2.2 |
Sources
- osv: GHSA-5286-f2rf-35c2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2
- https://nvd.nist.gov/vuln/detail/CVE-2023-28836
- https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62
- https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713
- https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af
- https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91
- https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview
- https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-55.yaml
- https://github.com/wagtail/wagtail
- https://github.com/wagtail/wagtail/releases/tag/v4.1.4
- https://github.com/wagtail/wagtail/releases/tag/v4.2.2
CVE-2023-28836 · published · modified · JSON