CVE-2024-39317

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39317", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-21T18:15:22.262Z", "datePublished": "2024-07-11T15:23:22.307Z", "dateUpdated": "2024-08-02T04:19:20.749Z"}, "containers": {"cna": {"title": "Wagtail regular expression denial-of-service via search query parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8"}, {"name": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2"}, {"name": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"}, {"name": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": ">= 2.0, < 5.2.6", "status": "affected"}, {"version": ">= 6.0, < 6.0.6", "status": "affected"}, {"version": ">= 6.1, < 6.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-11T15:23:22.307Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.\n"}], "source": {"advisory": "GHSA-jmp3-39vp-fwg8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-17T15:46:41.169788Z", "id": "CVE-2024-39317", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T15:20:35.111Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.749Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8"}, {"name": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2"}, {"name": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"}, {"name": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39317", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-21T18:15:22.262Z", "datePublished": "2024-07-11T15:23:22.307Z", "dateUpdated": "2024-07-18T15:20:35.111Z"}, "containers": {"cna": {"title": "Wagtail regular expression denial-of-service via search query parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8"}, {"name": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2"}, {"name": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"}, {"name": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": ">= 2.0, < 5.2.6", "status": "affected"}, {"version": ">= 6.0, < 6.0.6", "status": "affected"}, {"version": ">= 6.1, < 6.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-11T15:23:22.307Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.\n"}], "source": {"advisory": "GHSA-jmp3-39vp-fwg8", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-17T15:46:41.169788Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T15:20:28.844Z"}}]}}

{"affected": [{"affectedData": [{"product": "wagtail", "vendor": "wagtail", "versions": [{"status": "affected", "version": ">= 2.0, < 5.2.6"}, {"status": "affected", "version": ">= 6.0, < 6.0.6"}, {"status": "affected", "version": ">= 6.1, < 6.1.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "04E2B167-B135-4E11-9698-231D7F8E5C56", "versionEndExcluding": "5.2.6", "versionStartIncluding": "2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5C9D288-39EC-45CE-9E0D-176A6F0285B5", "versionEndExcluding": "6.0.6", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "B336D1C4-3530-4F3F-BE93-A669484230D0", "versionEndExcluding": "6.1.3", "versionStartIncluding": "6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.\n"}, {"lang": "es", "value": "Wagtail es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto construido sobre Django. Un error en `parse_query_string` de Wagtail provocar\u00eda que se tardara mucho en procesar las entradas adecuadamente manipuladas. Cuando se utiliza para analizar cadenas de caracteres suficientemente largas sin espacios, `parse_query_string` tardar\u00eda una cantidad de tiempo inesperadamente grande en procesarse, lo que provocar\u00eda una denegaci\u00f3n de servicio. En una instalaci\u00f3n inicial de Wagtail, cualquier usuario administrador de Wagtail puede aprovechar la vulnerabilidad. No puede ser explotado por los usuarios finales. Si su sitio Wagtail tiene una implementaci\u00f3n de b\u00fasqueda personalizada que utiliza `parse_query_string`, otros usuarios pueden explotarla (por ejemplo, usuarios no autenticados). Se han lanzado versiones parcheadas como Wagtail 5.2.6, 6.0.6 y 6.1.3."}], "id": "CVE-2024-39317", "lastModified": "2026-06-17T07:41:42.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-39317", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-17T15:46:41.169788Z", "version": "2.0.3"}}]}, "published": "2024-07-11T16:15:02.477", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1333"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}