Information Disclosure in Wagtail CMS

Executive Summary

This vulnerability affects Wagtail, an open source content management system built on Django. In certain versions prior to 7.0.8, 7.3.3, and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly displayed items to users who did not have permission to choose those items. Specifically, a user with access to the Wagtail admin interface could see filenames, names, and URLs of documents and images in collections they were not authorized to access.

The vulnerability does not affect ordinary site visitors without admin access, meaning only users with some level of admin access could exploit this information disclosure.

This issue was fixed in versions 7.0.8, 7.3.3, and 7.4.2 of Wagtail.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of filenames, names, and URLs of documents and images within Wagtail collections. This means that users with some admin access could view information they are not permitted to see, potentially exposing sensitive or confidential content.

However, the vulnerability does not allow modification or deletion of content, nor does it affect ordinary site visitors without admin access.

The impact is primarily information disclosure, which could lead to privacy concerns or leakage of sensitive data if the documents or images contain confidential information.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Wagtail to version 7.0.8, 7.3.3, or 7.4.2 or later, as these versions contain the fix for the issue.

Ensure that only trusted users have access to the Wagtail admin interface, since the vulnerability requires admin access to be exploitable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a user with access to the Wagtail admin to see filenames, names, and URLs of documents and images for which they do not have choose permission. This could potentially lead to unauthorized disclosure of information.

Since the vulnerability exposes information to users without proper permission, it may impact compliance with data protection regulations such as GDPR or HIPAA, which require strict access controls and protection of sensitive information.

However, the vulnerability is not exploitable by ordinary site visitors without admin access, which limits the scope of exposure.

Useful 0 Not Useful 0