GHSA-jjjr-3jcw-f8v6 · Severity: medium · Ecosystem: pip — Potential Observable Timing Discrepancy in Wagtail
In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ). Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.
Conclusion & alert: CVE-2020-11037 is rated Low Risk (29.1/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.05%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-17 | 0.04% | 0.05% | +0.01% |
| 2 | 2023-03-07 | 0.89% | 0.04% | -0.84% |
| 3 | 2022-04-01 | — | 0.89% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.1 | 3.1 | MEDIUM |
|
0.8 | 4.7 | [email protected] |
| 4.7 | 3.1 | MEDIUM |
|
1.0 | 3.6 | [email protected] |
| 1.9 | 2.0 | LOW |
|
3.4 | 2.9 | [email protected] |
GHSA-jjjr-3jcw-f8v6 · Severity: medium · Ecosystem: pip — Potential Observable Timing Discrepancy in Wagtail