CVE-2023-45809
CVSS 3.1 Score 2.7 of 10 (low)
Details
Summary
CVE-2023-45809 is a vulnerability affecting Wagtail, an open-source content management system built on Django. A limited-permission editor account in the Wagtail admin can access a direct URL request to the admin view for bulk actions on user accounts. Although the user cannot make any changes, the error message discloses user display names. By manipulating URL parameters, the user can retrieve the display name for any account. This vulnerability does not pose a threat to ordinary site visitors without access to the Wagtail admin. To mitigate this issue, users are advised to upgrade to Wagtail 4.1.8 (LTS), 5.0.5, or 5.1.3, which have patches available. Wagtail 5.2 Release Candidate 1 also includes the fix. There are no known workarounds for this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Torchbox Wagtail
Affected Vendors
- Torchbox
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions