GitHub Advisoryadvisory · PyPI
GHSA-7rp2-fm2h-wchj Django Cross-site Scripting in AdminURLFieldWidget
MEDIUM
Official page ↗
- Aliases
- CVE-2019-12308
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2019-06-10
Affected packages
• PyPI Django: >= 1.11a1, < 1.11.21 → fixed in 1.11.21
• PyPI Django: >= 2.1a1, < 2.1.9 → fixed in 2.1.9
• PyPI Django: >= 2.2a1, < 2.2.2 → fixed in 2.2.2
Description
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Related
Alias · CVE (1)
- CVE-2019-12308 An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-12308 advisory
- https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62 web
- https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673 web
- https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b web
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases web
- https://www.debian.org/security/2019/dsa-4476 web
- https://usn.ubuntu.com/4043-1 web
- https://security.gentoo.org/glsa/202004-17 web
- https://seclists.org/bugtraq/2019/Jul/10 web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G web
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html web
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html web
- https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8 web
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml web
- https://github.com/django/django package
- https://github.com/advisories/GHSA-7rp2-fm2h-wchj advisory
- https://docs.djangoproject.com/en/dev/releases/security web
- https://docs.djangoproject.com/en/dev/releases/2.2.2 web
- https://docs.djangoproject.com/en/dev/releases/2.1.9 web
- https://docs.djangoproject.com/en/dev/releases/1.11.21 web
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html web
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html web
- http://www.openwall.com/lists/oss-security/2019/06/03/2 web