CVE-2020-11037

Potential Observable Timing Discrepancy in Wagtail

Severity Score

4.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet. Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.

En Wagtail versiones anteriores a la versión 2.7.2 y 2.8.2, hay un posible ataque de sincronización en páginas o documentos que han sido protegidos con una contraseña compartida por medio de los controles "Privacy" de Wagtail. Esta comprobación de contraseña es realizada por medio de una comparación de cadena caracter por caracter, y que un atacante que sea capaz de medir el tiempo que toma esta comprobación con un alto grado de precisión podría utilizar las diferencias de sincronización para lograr conocer la contraseña. Es entendido que esto es factible en una red local, pero no sobre la Internet pública. La configuración de privacidad que restringe el acceso a páginas y documentos por usuario o por grupo (en lugar de una contraseña compartida) no están afectadas por esta vulnerabilidad. Esto ha sido parcheado en las versiones 2.7.3, 2.8.2, 2.9.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-03-30 CVE Reserved
2020-04-30 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-208: Observable Timing Discrepancy
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (1)

URL	Tag	Source
https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Torchbox Search vendor "Torchbox"		Wagtail Search vendor "Torchbox" for product "Wagtail"				>= 2.7 < 2.7.3 Search vendor "Torchbox" for product "Wagtail" and version " >= 2.7 < 2.7.3"		lts		Affected
Torchbox Search vendor "Torchbox"		Wagtail Search vendor "Torchbox" for product "Wagtail"				>= 2.8 < 2.8.2 Search vendor "Torchbox" for product "Wagtail" and version " >= 2.8 < 2.8.2"		-		Affected