CVE-2020-15118
2 advisories.
PyPI/wagtail CVE-2020-15118: medium 5.7, EPSS 1.10%
Cross-Site Scripting in Wagtail
Action: Upgrade wagtail to 2.7.4 or later.
pip install wagtail==2.9.3pip install wagtail==2.7.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.8rc1 | 2.9.3 | - |
| 0 | 2.7.4 | - |
Fixed versions
| 2.9.3 | 2.7.4 |
Sources
- osv: GHSA-2473-9hgq-j7xw
- https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw
- https://nvd.nist.gov/vuln/detail/CVE-2020-15118
- https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34
- https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text
- https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-154.yaml
- https://github.com/wagtail/wagtail
- https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
CVE-2020-15118 · published · modified · JSON
PyPI/wagtail CVE-2020-15118: unknown, EPSS 1.10%
In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard f
Action: Upgrade wagtail to 2.7.4 or later.
pip install wagtail==2.7.4pip install wagtail==2.9.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7 | 2.7.4 | - |
| 2.9 | 2.9.3 | - |
Fixed versions
| 2.7.4 | 2.9.3 |
Sources
- osv: PYSEC-2020-154
- https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage
- https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
- https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw
- https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34
- https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text
CVE-2020-15118 · published · modified · JSON