UpHeron
All vulnerabilities

Servers and applications

CVE-2020-11037

Potential timing attack on password-protected private pages

Severity
Medium 4.7
Published
30 Apr 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.7.2, 2.7.3, 2.8.2
Also known as
GHSA-jjjr-3jcw-f8v6
Sources
NVD, Project advisories (GitHub)

Description

In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • From 2.7 before 2.7.3
  • From 2.8 before 2.8.2
WagtailServers and applications · github:wagtail/wagtail
  • From 2.8 before 2.7.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-11037
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-11037
  • GitHub Advisory Database https://github.com/advisories/GHSA-jjjr-3jcw-f8v6
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6