CVE-2020-5240: labdigital wagtail-2fa

csirt@kutim:~/threat-intel/cve/CVE-2020-5240

CVSS 8.5 · High EPSS 1,00%

Kerentanan Improper Authorization pada labdigital wagtail-2fa. Skor CVSS 3.1 8.5 (High) menurut NVD.

Deskripsi (NVD)

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.

Rincian

Terbit di NVD: 13 Maret 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
CWE-863: Incorrect Authorization
EPSS (30 hari): 1,00% peluang dieksploitasi; lebih tinggi dari 61,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
labdigital	wagtail-2fa	Semua versi sebelum 1.4.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74 patch · advisory pihak ketiga
https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.