CVE-2023-45809

CVSS 3.1 Score 2.7 of 10 (low)

Details

Published Oct 19, 2023
Updated: Dec 28, 2023
CWE ID 200
CWE ID 532
CWE ID 425

Summary

CVE-2023-45809 is a vulnerability in the Wagtail content management system, which is built on Django. It allows a user with a limited-permission editor account to retrieve the display names of user accounts by making a direct URL request to the admin view that handles bulk actions on user accounts. Although the user cannot make any changes due to authentication rules, the error message discloses the display names of user accounts. The vulnerability can only be exploited by someone with access to the Wagtail admin. The issue has been patched in versions Wagtail 4.1.8 (LTS), 5.0.5, and 5.1.3, as well as in Release Candidate 1 of Wagtail 5.2. Upgrading to these versions is recommended, as there are no known workarounds for this vulnerability. The potential danger it poses to an organization is considered low, with a base severity score of LOW according to NVD@NIST.gov's rating system.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-45809 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options