kopia lustrzana https://github.com/wagtail/wagtail
Release note for CVE-2021-29434 in 2.11.7
rodzic
a44312f48f
commit
b3f3df2764
|
@ -93,6 +93,12 @@ Changelog
|
|||
* Fix: Prevent delete button showing on collection / workflow edit views when delete permission is absent (Helder Correia)
|
||||
|
||||
|
||||
2.11.7 (19.04.2021)
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix: CVE-2021-29434 - fix improper validation of URLs ('Cross-site Scripting') in rich text fields (Kevin Breen, Matt Westcott)
|
||||
|
||||
|
||||
2.11.6 (05.03.2021)
|
||||
~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
|
@ -0,0 +1,18 @@
|
|||
============================
|
||||
Wagtail 2.11.7 release notes
|
||||
============================
|
||||
|
||||
.. contents::
|
||||
:local:
|
||||
:depth: 1
|
||||
|
||||
|
||||
What's new
|
||||
==========
|
||||
|
||||
CVE-2021-29434: Improper validation of URLs ('Cross-site Scripting') in rich text fields
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This release addresses a cross-site scripting (XSS) vulnerability in rich text fields. When saving the contents of a rich text field in the admin interface, Wagtail did not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
|
||||
|
||||
Many thanks to Kevin Breen for reporting this issue.
|
|
@ -11,6 +11,7 @@ Release notes
|
|||
2.12.2
|
||||
2.12.1
|
||||
2.12
|
||||
2.11.7
|
||||
2.11.6
|
||||
2.11.5
|
||||
2.11.4
|
||||
|
|
Ładowanie…
Reference in New Issue