GitHub Advisoryadvisory · PyPI

GHSA-2m34-jcjv-45xf XSS in Django

MEDIUM Published 2020-06-05 Modified 2024-09-20 Official page ↗
Aliases
CVE-2020-13596
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-04

Affected packages

• PyPI Django: >= 2.2a1, < 2.2.13 → fixed in 2.2.13 • PyPI Django: >= 3.0a1, < 3.0.7 → fixed in 3.0.7

Description

An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

Related

Alias · CVE (1)

  • CVE-2020-13596 An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References