Security readout for executives and security teams
Plain-English summary
Some Wagtail sites used a password check that could leak tiny timing clues when protecting pages or documents with a shared password. The issue matters most where an attacker can measure responses very accurately, such as on a local network.
Executive priority
Treat as a targeted, moderate-risk issue. Prioritize remediation for intranet, campus, office, or hosting environments where an attacker may share the network and protected content is sensitive.
Technical view
CVE-2020-11037 is a CWE-208 timing discrepancy in Wagtail shared-password Privacy controls. Affected versions compare passwords character by character, potentially revealing password information through response timing. Per-user and per-group privacy restrictions are not affected.
Likely exposure
Exposure is limited to Wagtail before 2.7.3, 2.8 release candidates through before 2.8.2, and 2.9rc1 where shared-password Privacy controls protect pages or documents.
Exploitation context
The sources do not report active exploitation, and KEV status is false. The advisory describes exploitation as requiring highly accurate timing measurement and being feasible on a local network, not the public internet.
Researcher notes
The vulnerable condition is the shared-password privacy check, not all Wagtail authentication. The source bundle names patches but does not provide evidence of public internet feasibility or active exploitation.
Mitigation direction
- Upgrade Wagtail to 2.7.3, 2.8.2, 2.9, or later.
- Identify pages or documents protected by shared Privacy passwords.
- Prefer per-user or per-group access controls where operationally appropriate.
- Review vendor advisory and release notes before changing production systems.
Validation and detection
- Inventory deployed Wagtail versions across production and internal environments.
- Check whether shared-password Privacy controls are used on pages or documents.
- Confirm upgraded instances run a patched Wagtail version.
- Document any remaining shared-password protected content and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-208: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-11037 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N0.84.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wagtail/wagtail/security/advisories/GHSA-jjjr-3jcw-f8v6CVE reference · x_refsource_CONFIRM
- https://github.com/wagtail/wagtail/commit/3c030490ed575bb9cd01dfb3a890477dcaeb2edfCVE reference · x_refsource_MISC
- https://github.com/wagtail/wagtail/commit/b76ab57ee859732b9cf9287d380493ab24061090CVE reference · x_refsource_MISC
- https://github.com/wagtail/wagtail/commit/ba9d424bd1ca5ce1910d3de74f5cc07214fbfb11CVE reference · x_refsource_MISC
- https://github.com/wagtail/wagtail/commit/bac3cd0a26b023e595cf2959aae7da15bb5e4340CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Timing Discrepancy
Observable Timing Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.