GitHub Advisoryadvisory · PyPI

GHSA-hx7c-qpfq-xcrp Cross-site Scripting in django-cms

MEDIUM Published 2022-01-13 Modified 2024-09-16 Official page ↗
Aliases
CVE-2021-44649
Ecosystem
PyPI
Packages
django-cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-01-13

Affected packages

• PyPI django-cms: >= 3.7.0, < 3.7.4 → fixed in 3.7.4 • PyPI django-cms: >= 3.6.0, < 3.6.1 → fixed in 3.6.1 • PyPI django-cms: >= 3.5.0, < 3.5.4 → fixed in 3.5.4 • PyPI django-cms: >= 3.4.0, < 3.4.7 → fixed in 3.4.7

Description

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.

Related

Alias · CVE (1)

  • CVE-2021-44649 Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References