~ / search / GHSA-89px-ww3j-g2mm

GHSA-89px-ww3j-g2mm

2FA bypass in Wagtail through new device path

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-16766

Packages

EcosystemPackageAffectedFixed in
PyPI wagtail-2fa < 1.3.0 1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

## 2FA bypass through new device path ### Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. ### Patches This problem has been patched in version 1.3.0. ### Workarounds There is no workaround at the moment. ### For more information If you have any questions or comments about this advisory: * Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa) * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.