{"action":"Upgrade wagtail-2fa to 1.4.1 or later.","affected":[{"fixed":"1.4.1","introduced":"0"}],"component":"wagtail-2fa","cve_ids":["CVE-2020-5240"],"ecosystem":"PyPI","epss":0.00999,"exploited":false,"fixed_versions":["1.4.1"],"ghsa_id":"GHSA-9gjv-6qq6-v7qm","id":"tcs_01M5KG9VT4JFDK3BJ3Z6B1HCVV","modified_at":"2023-11-08T04:03:52.662840Z","published_at":"2020-03-13T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-219","https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74","https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-219","url":"https://osv.dev/vulnerability/PYSEC-2020-219"}],"summary":"In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so."}