{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-19T14:07:11.230Z", "datePublished": "2024-05-02T06:52:59.556Z", "dateUpdated": "2024-06-04T17:50:26.488Z"}, "containers": {"cna": {"title": "Permission check bypass when editing a model with per-field restrictions in wagtail", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges ", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-281", "lang": "en", "description": "CWE-281: Improper Preservation of Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"}, {"name": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"}, {"name": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset", "tags": ["x_refsource_MISC"], "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"}, {"name": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html", "tags": ["x_refsource_MISC"], "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"}, {"name": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission", "tags": ["x_refsource_MISC"], "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": ">= 6.0.0, < 6.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-02T06:52:59.556Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level."}], "source": {"advisory": "GHSA-w2v8-php4-p8hc", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:08:02.482926Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wagtail:wagtail:6.0.0:*:*:*:*:*:*:*"], "vendor": "wagtail", "product": "wagtail", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.0.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:50:26.488Z"}}]}}

{"descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level."}, {"lang": "es", "value": "Wagtail es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto construido sobre Django. En las versiones afectadas, si un modelo se ha puesto a disposici\u00f3n para su edici\u00f3n a trav\u00e9s del m\u00f3dulo `wagtail.contrib.settings` o `ModelViewSet`, y el argumento `permission` en `FieldPanel` se ha utilizado para restringir a\u00fan m\u00e1s el acceso a uno o m\u00e1s campos de En el modelo, un usuario con permiso de edici\u00f3n sobre el modelo pero no sobre el campo espec\u00edfico puede crear una solicitud HTTP POST que omita la verificaci\u00f3n de permiso en el campo individual, permiti\u00e9ndole actualizar su valor. Esta vulnerabilidad no es aprovechable por un visitante normal del sitio sin acceso al administrador de Wagtail, ni por un usuario al que no se le ha concedido acceso de edici\u00f3n al modelo en cuesti\u00f3n. Las interfaces de edici\u00f3n de p\u00e1ginas y fragmentos tampoco se ven afectadas. Se han lanzado versiones parcheadas como Wagtail 6.0.3 y 6.1. Las versiones de Wagtail anteriores a la 6.0 no se ven afectadas. Se recomienda a los usuarios que actualicen. Los propietarios de sitios que no puedan actualizar a una versi\u00f3n parcheada pueden evitar la vulnerabilidad de la siguiente manera: 1. Para los modelos registrados a trav\u00e9s de `ModelViewSet`, registre el modelo como un fragmento; 2. Para los modelos de configuraci\u00f3n, coloque los campos restringidos en un modelo de configuraci\u00f3n separado y configure el permiso en el nivel del modelo."}], "id": "CVE-2024-32882", "lastModified": "2024-05-02T13:27:25.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-05-02T07:15:20.967", "references": [{"source": "security-advisories@github.com", "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"}, {"source": "security-advisories@github.com", "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"}, {"source": "security-advisories@github.com", "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"}, {"source": "security-advisories@github.com", "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"}, {"source": "security-advisories@github.com", "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}, {"lang": "en", "value": "CWE-281"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}