{"action":"Upgrade wagtail to 2.7.3 or later.","affected":[{"fixed":"2.7.3","introduced":"2.7"},{"fixed":"2.8.2","introduced":"2.8"}],"component":"wagtail","cve_ids":["CVE-2020-11037"],"ecosystem":"PyPI","epss":0.0025,"exploited":false,"fixed_versions":["2.7.3","2.8.2"],"ghsa_id":"GHSA-jjjr-3jcw-f8v6","id":"tcs_01M5KG9KTBKRGGGP6ABZJQZJHC","modified_at":"2026-06-08T11:15:04.223652604Z","published_at":"2020-04-30T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-153","https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"PYSEC-2020-153","url":"https://osv.dev/vulnerability/PYSEC-2020-153"},{"source":"nvd","source_id":"CVE-2020-11037","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11037"}],"summary":"In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's \"Privacy\" controls. This password c"}