CVE-2021-29434

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).

Wagtail es un sistema de gestión de contenido de Django. En las versiones afectadas de Wagtail, al guardar el contenido de un campo de texto enriquecido en la interfaz de administración, Wagtail no aplica comprobaciones del lado del servidor para garantizar a las URL de los enlaces usar un protocolo válido. Un usuario malicioso con acceso a la interfaz de administración podría entonces diseñar una petición POST para publicar contenido con URLs "javascript:" que contengan código arbitrario. La vulnerabilidad no es explotable por un visitante ordinario del sitio sin acceso al administrador de Wagtail. Véase el aviso de GitHub al que se hace referencia para obtener detalles adicionales, incluyendo una solución alternativa. Las versiones parcheadas ha sido lanzadas como Wagtail versión 2.11.7 (para la rama LTS 2.11) y Wagtail versión 2.12.4 (para la rama 2.12 actual)

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-03-30 CVE Reserved
2021-04-19 CVE Published
2023-03-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (2)

URL	Tag	Source
https://github.com/wagtail/wagtail/security/advisories/GHSA-wq5h-f9p5-q7fx	Mitigation
https://pypi.org/project/wagtail	Product

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Torchbox Search vendor "Torchbox"		Wagtail Search vendor "Torchbox" for product "Wagtail"				< 2.11.6 Search vendor "Torchbox" for product "Wagtail" and version " < 2.11.6"		-		Affected
Torchbox Search vendor "Torchbox"		Wagtail Search vendor "Torchbox" for product "Wagtail"				>= 2.11.0 < 2.11.7 Search vendor "Torchbox" for product "Wagtail" and version " >= 2.11.0 < 2.11.7"		lts		Affected
Torchbox Search vendor "Torchbox"		Wagtail Search vendor "Torchbox" for product "Wagtail"				>= 2.12.0 < 2.12.4 Search vendor "Torchbox" for product "Wagtail" and version " >= 2.12.0 < 2.12.4"		-		Affected