Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/81144?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/81144?format=api", "purl": "pkg:pypi/wagtail@6.0.0", "type": "pypi", "namespace": "", "name": "wagtail", "version": "6.0.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "7.0.7", "latest_non_vulnerable_version": "7.3.2", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54707?format=api", "vulnerability_id": "VCID-dw47-n3f3-ffa2", "summary": "Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`\nIf a model has been made available for editing through the [`wagtail.contrib.settings`](https://docs.wagtail.org/en/stable/reference/contrib/settings.html) module or [`ModelViewSet`](https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset), and the [`permission` argument on `FieldPanel`](https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission) has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value.\n\nThe vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-32882", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00083", "scoring_system": "epss", "scoring_elements": "0.24345", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-32882" }, { "reference_url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-02T13:08:02Z/" } ], "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset" }, { "reference_url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-02T13:08:02Z/" } ], "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html" }, { "reference_url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-02T13:08:02Z/" } ], "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission" }, { "reference_url": "https://github.com/wagtail/wagtail", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/wagtail/wagtail" }, { "reference_url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-02T13:08:02Z/" } ], "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b" }, { "reference_url": "https://github.com/wagtail/wagtail/commit/fa0d4829f9c81eefb37cc058e2fa1b6a918741da", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/wagtail/wagtail/commit/fa0d4829f9c81eefb37cc058e2fa1b6a918741da" }, { "reference_url": "https://github.com/wagtail/wagtail/releases/tag/v6.0.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/wagtail/wagtail/releases/tag/v6.0.3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32882", "reference_id": "CVE-2024-32882", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32882" }, { "reference_url": "https://github.com/advisories/GHSA-w2v8-php4-p8hc", "reference_id": "GHSA-w2v8-php4-p8hc", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w2v8-php4-p8hc" }, { "reference_url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc", "reference_id": "GHSA-w2v8-php4-p8hc", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-02T13:08:02Z/" } ], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/41857?format=api", "purl": "pkg:pypi/wagtail@6.0.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-22sk-jw8g-byek" }, { "vulnerability": "VCID-39ey-uzfk-8qh3" }, { "vulnerability": "VCID-8vb4-y953-b7dp" }, { "vulnerability": "VCID-ehpx-45mk-kya5" }, { "vulnerability": "VCID-esy5-hesv-zyf7" }, { "vulnerability": "VCID-k7jj-wh5a-kudh" }, { "vulnerability": "VCID-kphk-eqcu-fuhd" }, { "vulnerability": "VCID-mj1d-3up9-2bbs" }, { "vulnerability": "VCID-rks7-49ud-u7g2" }, { "vulnerability": "VCID-vzg1-msbd-g3hm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/wagtail@6.0.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/50259?format=api", "purl": "pkg:pypi/wagtail@6.1rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-22sk-jw8g-byek" }, { "vulnerability": "VCID-39ey-uzfk-8qh3" }, { "vulnerability": "VCID-8vb4-y953-b7dp" }, { "vulnerability": "VCID-esy5-hesv-zyf7" }, { "vulnerability": "VCID-kphk-eqcu-fuhd" }, { "vulnerability": "VCID-mj1d-3up9-2bbs" }, { "vulnerability": "VCID-rks7-49ud-u7g2" }, { "vulnerability": "VCID-vzg1-msbd-g3hm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/wagtail@6.1rc1" } ], "aliases": [ "CVE-2024-32882", "GHSA-w2v8-php4-p8hc" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dw47-n3f3-ffa2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55160?format=api", "vulnerability_id": "VCID-ehpx-45mk-kya5", "summary": "Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`\nDue to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-35228", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0016", "scoring_system": "epss", "scoring_elements": "0.36691", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-35228" }, { "reference_url": "https://github.com/wagtail/wagtail", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/wagtail/wagtail" }, { "reference_url": "https://github.com/wagtail/wagtail/commit/284f75a6f91f7ab18cc304d7d34f33b559ae37b1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-31T16:19:13Z/" } ], "url": "https://github.com/wagtail/wagtail/commit/284f75a6f91f7ab18cc304d7d34f33b559ae37b1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35228", "reference_id": "CVE-2024-35228", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35228" }, { "reference_url": "https://github.com/advisories/GHSA-xxfm-vmcf-g33f", "reference_id": "GHSA-xxfm-vmcf-g33f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xxfm-vmcf-g33f" }, { "reference_url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f", "reference_id": "GHSA-xxfm-vmcf-g33f", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-31T16:19:13Z/" } ], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/41859?format=api", "purl": "pkg:pypi/wagtail@6.0.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-22sk-jw8g-byek" }, { "vulnerability": "VCID-39ey-uzfk-8qh3" }, { "vulnerability": "VCID-8vb4-y953-b7dp" }, { "vulnerability": "VCID-esy5-hesv-zyf7" }, { "vulnerability": "VCID-k7jj-wh5a-kudh" }, { "vulnerability": "VCID-kphk-eqcu-fuhd" }, { "vulnerability": "VCID-mj1d-3up9-2bbs" }, { "vulnerability": "VCID-rks7-49ud-u7g2" }, { "vulnerability": "VCID-vzg1-msbd-g3hm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/wagtail@6.0.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/41862?format=api", "purl": "pkg:pypi/wagtail@6.1.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-22sk-jw8g-byek" }, { "vulnerability": "VCID-39ey-uzfk-8qh3" }, { "vulnerability": "VCID-8vb4-y953-b7dp" }, { "vulnerability": "VCID-esy5-hesv-zyf7" }, { "vulnerability": "VCID-k7jj-wh5a-kudh" }, { "vulnerability": "VCID-kphk-eqcu-fuhd" }, { "vulnerability": "VCID-mj1d-3up9-2bbs" }, { "vulnerability": "VCID-rks7-49ud-u7g2" }, { "vulnerability": "VCID-vzg1-msbd-g3hm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/wagtail@6.1.2" } ], "aliases": [ "CVE-2024-35228", "GHSA-xxfm-vmcf-g33f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ehpx-45mk-kya5" } ], "fixing_vulnerabilities": [], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/wagtail@6.0.0" }