CVE-2020-11037: Potential Observable Timing Discrepancy in Wagtail
Summary
CVE-2020-11037: Potential Observable Timing Discrepancy in Wagtail. Affects wagtail across 3 version ranges.
< 2.7.3
>= 2.8rc1, < 2.8.2
>= 2.9rc1, < 2.9
Fixed in 2.7.3, 2.8.2 or 2.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, designed to simplify the process of creating and managing websites. It provides a user-friendly interface for content editing and offers various features for website customization. However, Wagtail is vulnerable to a potential timing attack on pages or documents that have been protected with a shared password through its "Privacy" controls. This vulnerability arises from the character-by-character string comparison used for password checks, which can be exploited by an attacker with precise timing measurements to gain knowledge of the password. It is important to note that this attack is believed to be feasible only on a local network and not on the public internet. Privacy settings that restrict access on a per-user or per-group basis are not affected by this vulnerability.
Vulnerability Detail
The vulnerability in Wagtail allows an attacker to potentially exploit timing differences in the password check process to obtain the shared password used for protecting pages or documents. By carefully measuring the time taken for each character comparison, an attacker can deduce the correct password character by character. This vulnerability has a moderate severity rating with a CVSS score of 6.1. It is crucial for Wagtail users to be aware of this issue and take appropriate measures to mitigate the risk.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.32.7.3pip install --upgrade "wagtail==2.7.3" -
>= 2.8rc1, < 2.8.22.8.2pip install --upgrade "wagtail==2.8.2" -
>= 2.9rc1, < 2.92.9pip install --upgrade "wagtail==2.9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, site owners can implement user- or group-based privacy restrictions to limit access to sensitive information. By utilizing these privacy settings, which are unaffected by the vulnerability, site owners can ensure the protection of their content until they are able to upgrade to the fixed versions.
Conclusion
In conclusion, Wagtail is susceptible to a potential timing attack that can compromise shared passwords used for protecting pages or documents. To mitigate this vulnerability, it is recommended to upgrade to the patched versions provided by the Wagtail development team. Alternatively, site owners can implement user- or group-based privacy restrictions as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open-source content management system (CMS) built on Django, designed to simplify the process of creating and managing websites.
The vulnerability allows an attacker to potentially deduce the shared password used for protecting pages or documents in Wagtail through precise timing measurements.
No, the timing attack is believed to be feasible only on a local network and not on the public internet.
No, privacy settings based on user or group restrictions are unaffected by this vulnerability.
The vulnerability has a moderate severity rating with a CVSS score of 6.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
