Potential Observable Timing Discrepancy in Wagtail
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.
Summary
In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ). Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wagtail | Wagtail | before 2.7.3; 2.8rc1 to before 2.8.2; = 2.9rc1 | 2.7.3, 2.8.2 | Patch available | CNA |
| — | wagtail (PyPI) | before 2.7.3 | 2.7.3 | Patch available | GHSA-jjjr-3jcw-f8v6 |
| — | wagtail (PyPI) | 2.8rc1 to before 2.8.2 | 2.8.2 | Patch available | GHSA-jjjr-3jcw-f8v6 |
| — | wagtail (PyPI) | 2.9rc1 to before 2.9 | 2.9 | Patch available | GHSA-jjjr-3jcw-f8v6 |
- Wagtail Vendorwagtail Affected before 2.7.3; 2.8rc1 to before 2.8.2; = 2.9rc1 Fixed in 2.7.3, 2.8.2 Patch available CNA
- wagtail (PyPI) Vendor— Affected before 2.7.3 Fixed in 2.7.3 Patch available GHSA-jjjr-3jcw-f8v6
- wagtail (PyPI) Vendor— Affected 2.8rc1 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-jjjr-3jcw-f8v6
- wagtail (PyPI) Vendor— Affected 2.9rc1 to before 2.9 Fixed in 2.9 Patch available GHSA-jjjr-3jcw-f8v6
Remediation
- Fix · CNA Wagtail (wagtail) Fixed in 2.7.3, 2.8.2
- Fix · GHSA-jjjr-3jcw-f8v6 wagtail (PyPI) Fixed in 2.7.3 Advisory →
- Fix · GHSA-jjjr-3jcw-f8v6 wagtail (PyPI) Fixed in 2.8.2 Advisory →
- Fix · GHSA-jjjr-3jcw-f8v6 wagtail (PyPI) Fixed in 2.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11037
- 2026-10-03 Alias added: GHSA-jjjr-3jcw-f8v6
References
Advisory 2
Other 6
- https://github.com/wagtail/wagtail/commit/3c030490ed575bb9cd01dfb3a890477dcaeb2edf
- https://github.com/wagtail/wagtail/commit/b76ab57ee859732b9cf9287d380493ab24061090
- https://github.com/wagtail/wagtail/commit/ba9d424bd1ca5ce1910d3de74f5cc07214fbfb11
- https://github.com/wagtail/wagtail/commit/bac3cd0a26b023e595cf2959aae7da15bb5e4340
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-153.yaml
- https://github.com/wagtail/wagtail
More Wagtail vulnerabilities
- TI-2026-39163 Wagtail: Reflected XSS in dynamic image URL generator view CVSS 3.1HIGH 7.3
- TI-2020-08875 Possible XSS attack in Wagtail CVSS 3.1MEDIUM 6.8
- TI-2023-13342 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVSS 3.1MEDIUM 6.4
- TI-2026-32180 Wagtail: Improper restriction handling on Documents and Images API CVSS 3.1MEDIUM 5.3
- TI-2026-22558 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CVSS 3.1MEDIUM 6.1
- TI-2026-22557 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-11037 · CVE Program
- CVE-2020-11037 · NVD
- FIRST EPSS
- GHSA-jjjr-3jcw-f8v6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences