CVE-2019-16766

Advisory

Wagtail-2fa version 1.3.0 includes a fix for CVE-2019-16766: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

==================
- Add OtpRequiredMixin to enforce OTP checks in views
- Resolve possible vulnerabilities:
- [CWE-290](http://cwe.mitre.org/data/definitions/290.html)
- [CWE-20](http://cwe.mitre.org/data/definitions/20.html)

Resources

• https://pypi.org/project/wagtail-2fa
• https://pyup.io/changelogs/wagtail-2fa/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16766
• https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm
• https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca
• https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81