GitHub Advisoryadvisory · PyPI

GHSA-54qj-48vx-cr9f Django Cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-01 Modified 2024-09-16 Official page ↗
Aliases
CVE-2008-2302
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-09-22

Affected packages

• PyPI Django: >= 0.91, < 0.91.2 → fixed in 0.91.2 • PyPI Django: >= 0.95, < 0.95.3 → fixed in 0.95.3 • PyPI Django: >= 0.96, < 0.96.2 → fixed in 0.96.2

Description

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

Related

Alias · CVE (1)

  • CVE-2008-2302 Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References