Release notes for 2.7.2

gasman · gasman · commit 55cb4b8809ba · 2020-04-14T02:13:45.000+01:00
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -1,6 +1,12 @@
 Changelog
 =========
 
+2.7.2 (14.04.2020)
+~~~~~~~~~~~~~~~~~~
+
+ * Fix: CVE-2020-11001 - prevent XSS attack via page revision comparison view (Vlad Gerasimenko, Matt Westcott)
+
+
 2.7.1 (08.01.2020)
 ~~~~~~~~~~~~~~~~~~
 
diff --git a/CONTRIBUTORS.rst b/CONTRIBUTORS.rst
@@ -418,6 +418,7 @@ Contributors
 * ryanomor
 * Thijs Baaijen
 * Stefani Castellanos
+* Vlad Gerasimenko
 
 Translators
 ===========
diff --git a/docs/releases/2.7.2.rst b/docs/releases/2.7.2.rst
@@ -0,0 +1,10 @@
+===========================
+Wagtail 2.7.2 release notes
+===========================
+
+CVE-2020-11001: Possible XSS attack via page revision comparison view
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This release addresses a cross-site scripting (XSS) vulnerability on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
+
+Many thanks to Vlad Gerasimenko for reporting this issue.
diff --git a/docs/releases/index.rst b/docs/releases/index.rst
@@ -5,6 +5,7 @@ Release notes
    :maxdepth: 1
 
    upgrading
+   2.7.2
    2.7.1
    2.7
    2.6.3
