CVE-2020-11037: Timing Attack Vulnerability in Wagtail
Summary
CVE-2020-11037: In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. Affects wagtail across 2 version ranges.
>= 2.7, < 2.7.3
>= 2.8, < 2.8.2
Fixed in 2.7.3 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) written in Python. It provides a user-friendly interface for managing website content and has various features for creating and organizing web pages. The CMS allows administrators to protect pages or documents with a shared password through its "Privacy" controls. However, versions 2.7.2 and 2.8.2 of Wagtail are vulnerable to a timing attack on these protected pages or documents.
Vulnerability Detail
The vulnerability in Wagtail arises from the way the password check is performed on protected pages or documents. The check uses a character-by-character string comparison, which can be exploited by an attacker with high accuracy in measuring the time taken for the check. By analyzing timing differences, an attacker could potentially deduce the password used to protect the content. It is important to note that this attack is feasible on a local network but not on the public internet. Privacy settings that restrict access on a per-user or per-group basis are not affected by this vulnerability.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.32.7.3pip install --upgrade "wagtail==2.7.3" -
>= 2.8, < 2.8.22.8.2pip install --upgrade "wagtail==2.8.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, Wagtail versions 2.7.2 and 2.8.2 are vulnerable to a timing attack on protected pages or documents. Upgrading to the patched versions, such as 2.7.3, 2.8.2, or 2.9, is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open-source content management system (CMS) written in Python. It provides a user-friendly interface for managing website content and has various features for creating and organizing web pages.
A timing attack is a type of side-channel attack where an attacker measures the time taken by a cryptographic operation or other sensitive process to gain information about secret data, such as a password.
The timing attack in Wagtail takes advantage of the character-by-character string comparison used in the password check for protected pages or documents. By measuring the time taken for this check, an attacker can deduce the password through timing differences.
No, this vulnerability is understood to be feasible only on a local network and not on the public internet.
Yes, privacy settings that restrict access on a per-user or per-group basis are not affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
