CVE-2020-5240

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.

• CWE-285
• CWE-863

• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74Patch, Third Party Advisory
• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qmThird Party Advisory
• https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74Patch, Third Party Advisory
• https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qmThird Party Advisory

Published

Mar 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5234MessagePack for C# and Unity before version 1.9.11 and 2.1.9…6.5
• CVE-2020-5235There is a potentially exploitable out of memory condition I…9.8
• CVE-2020-5236Waitress version 1.4.2 allows a DOS attack When waitress rec…6.5
• CVE-2020-5237Multiple relative path traversal vulnerabilities in the oneu…8.8
• CVE-2020-5238The table extension in GitHub Flavored Markdown before versi…6.5
• CVE-2020-5239In Mailu before version 1.7, an authenticated user can explo…8.8
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8
• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5245Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arb…8.8
• CVE-2020-5246Traccar GPS Tracking System before version 4.9 has a LDAP in…6.5