CVE-2020-11001

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-79CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-110028.8dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identCVE-2020-110038.1Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computerCVE-2020-110047.5SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input CVE-2020-110055.5The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encCVE-2020-110065.4In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is feCVE-2020-110076.5In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorCVE-2020-110087.5Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attackeCVE-2020-110096.5In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are CVE-2020-11015.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesCVE-2020-110108.8In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing masCVE-2020-110118.8In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This isCVE-2020-110127.5MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it