Is CVE-2020-15118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15118 being exploited in the wild.

How severe is CVE-2020-15118?

Low severity, with a CVSS score of 3.1, published 20 July 2020.

Which products and versions are affected?

wagtail (PyPI) GIT:introduced=0,fixed=d9a41e7f24d08c024acc9a3094940199df94db34|ECOSYSTEM:introduced=2.7,fixed=2.7.4,introduced=2.9,fixed=2.9.3; Wagtail <2.7.4, 2.8-2.8.2, 2.9-2.9.2.

Is there a fix for CVE-2020-15118?

Yes. wagtail (PyPI): upgrade to 2.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15118 attacked?

It is attacked over the network.

Am I affected by CVE-2020-15118?

Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15118: Wagtail cross-site scripting in form field help text

Q: Is there a fix for CVE-2020-15118?

Yes. wagtail (PyPI): upgrade to 2.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-15118 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2020-15118?

Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15118 · Severity: low · CVSS 3.1 · Published 2020-07-20

Wagtail is a content management system used by website editors to manage pages and forms. When form pages are configured with help text, unescaped HTML tags within that help text are rendered directly to end users, allowing a malicious editor to inject JavaScript code that could steal credentials, modify page content, or escalate their account privileges. The vulnerability requires admin-level access to Wagtail to exploit, and does not affect ordinary website visitors.

Technologies: wagtail (PyPI), Wagtail. Vendors: PyPI, Wagtail.

Quick answers

Is CVE-2020-15118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15118 being exploited in the wild.
How severe is CVE-2020-15118?: Low severity, with a CVSS score of 3.1, published 20 July 2020.
Which products and versions are affected?: wagtail (PyPI) GIT:introduced=0,fixed=d9a41e7f24d08c024acc9a3094940199df94db34|ECOSYSTEM:introduced=2.7,fixed=2.7.4,introduced=2.9,fixed=2.9.3; Wagtail <2.7.4, 2.8-2.8.2, 2.9-2.9.2.
Is there a fix for CVE-2020-15118?: Yes. wagtail (PyPI): upgrade to 2.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15118 attacked?: It is attacked over the network.
Am I affected by CVE-2020-15118?: Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wagtail (PyPI): upgrade to 2.9.3 or later
```
pip install "wagtail>=2.9.3"
```

Technical details

This is a cross-site scripting (XSS) vulnerability in the wagtail.contrib.forms app, specifically in how form field help text is rendered when using Django's standard form rendering helpers like form.as_p. The root cause is that HTML tags in help text fields are not escaped before output, despite Wagtail's policy of disallowing arbitrary HTML insertion by editors by default. An authenticated editor with form creation/modification privileges can inject malicious HTML and JavaScript into help text, which will execute in the browsers of end users viewing the form. The vulnerability requires authentication and user interaction (visiting the affected form page) but could enable privilege escalation or account compromise. Patches are available in Wagtail 2.7.4 and 2.9.3, which escape help text output by default; administrators can re-enable HTML via a configuration flag if needed.

Affected products

Wagtail Wagtail <2.7.4, 2.8-2.8.2, 2.9-2.9.2

Identifiers

CVE-2020-15118
GHSA-2473-9hgq-j7xw
PYSEC-2020-154

Timeline

2020-07-20: disclosed

References

https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.