CVEvulnerability
CVE-2019-12308
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-06-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Affected configurations
• djangoproject django (>= 1.11 < 1.11.21)
• djangoproject django (>= 2.1 < 2.1.9)
• djangoproject django (>= 2.2 < 2.2.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html lists.opensuse.org
- http://www.openwall.com/lists/oss-security/2019/06/03/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108559 www.securityfocus.com
- https://docs.djangoproject.com/en/dev/releases/1.11.21/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/2.1.9/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/2.2.2/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8 groups.google.com
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Jul/10 seclists.org
- https://security.gentoo.org/glsa/202004-17 security.gentoo.org
- https://usn.ubuntu.com/4043-1/ usn.ubuntu.com
- https://www.debian.org/security/2019/dsa-4476 www.debian.org
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html lists.opensuse.org
- http://www.openwall.com/lists/oss-security/2019/06/03/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108559 www.securityfocus.com
- https://docs.djangoproject.com/en/dev/releases/1.11.21/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/2.1.9/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/2.2.2/ Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8 groups.google.com
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Jul/10 seclists.org
- https://security.gentoo.org/glsa/202004-17 security.gentoo.org
- https://usn.ubuntu.com/4043-1/ usn.ubuntu.com
- https://www.debian.org/security/2019/dsa-4476 www.debian.org
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ Vendor Advisory