XSS in Django
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-13596US | medium6.1 | — | ||
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leadin… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.djangoproject.com/en/3.0/releases/securityWEB
- https://github.com/advisories/GHSA-2m34-jcjv-45xfADVISORY
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/1f2dd37f6fcefdd10ed44cb233b2e62b520afb38WEB
- https://github.com/django/django/commit/6d61860b22875f358fac83d903dc629897934815WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-32.yamlWEB
- https://groups.google.com/forum/#!msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan