mirrors/wagtail
mirrors/wagtail
0
0
Fork 0
mirror of https://github.com/wagtail/wagtail.git synced 2024-11-21 18:09:02 +01:00
Code Issues Releases Wiki Activity

Add 5.0.5 release note page

Browse Source
This commit is contained in:
Matt Westcott 2023-10-19 15:01:55 +01:00
parent 664f2e914a
commit 429dec0f1e
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
docs/releases/5.0.5.md Normal file
View File

@ -0,0 +1,18 @@
# Wagtail 5.0.5 release notes
_October 19, 2023_
```{contents}
---
local:
depth: 1
---
```
## What's new
### CVE-2023-45809: Disclosure of user names via admin bulk action views
This release addresses an information disclosure vulnerability in the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Many thanks to quyenheu for reporting this issue. For further details, please see [the CVE-2023-45809 security advisory](https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h).