CVE-2023-45809

Summary

CVE-2023-45809 is a vulnerability affecting Wagtail, an open-source content management system built on Django. A limited-permission editor account in the Wagtail admin can access a direct URL request to the admin view for bulk actions on user accounts. Although the user cannot make any changes, the error message discloses user display names. By manipulating URL parameters, the user can retrieve the display name for any account. This vulnerability does not pose a threat to ordinary site visitors without access to the Wagtail admin. To mitigate this issue, users are advised to upgrade to Wagtail 4.1.8 (LTS), 5.0.5, or 5.1.3, which have patches available. Wagtail 5.2 Release Candidate 1 also includes the fix. There are no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.