UpHeron
All vulnerabilities

Servers and applications

CVE-2020-11001

Possible XSS attack via page revision comparison view

Severity
Medium 6.8
Published
14 Apr 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-v2wc-pfq2-5cm6
Sources
NVD, Project advisories (GitHub)

Description

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • From 1.9 up to 2.7.1
  • Version 2.8
WagtailServers and applications · github:wagtail/wagtail
  • Version 2.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-11001
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-11001
  • GitHub Advisory Database https://github.com/advisories/GHSA-v2wc-pfq2-5cm6
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6