CVE-2019-16766
2 advisories.
PyPI/wagtail-2fa CVE-2019-16766: high 8.7
2FA bypass in Wagtail through new device path
Action: Upgrade wagtail-2fa to 1.3.0 or later.
pip install wagtail-2fa==1.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.0 | - |
Fixed versions
| 1.3.0 |
Sources
- osv: GHSA-89px-ww3j-g2mm
- https://github.com/labd/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm
- https://nvd.nist.gov/vuln/detail/CVE-2019-16766
- https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca
- https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81
- https://github.com/labd/wagtail-2fa
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2019-135.yaml
CVE-2019-16766 · published · modified · JSON
PyPI/wagtail-2fa CVE-2019-16766: unknown
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new dev
Action: Upgrade wagtail-2fa to 1.3.0 or later.
pip install wagtail-2fa==1.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.0 | - |
Fixed versions
| 1.3.0 |
Sources
- osv: PYSEC-2019-135
- https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm
- https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca
- https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81
CVE-2019-16766 · published · modified · JSON