Cross-site Scripting (XSS) in Django REST Framework
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-25626US | medium6.1 | — | ||
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain str… | ||||
02
references
External citations — patches, advisories, analysis.
- https://bugzilla.redhat.com/show_bug.cgi?id=1878635WEB
- https://github.com/advisories/GHSA-fx83-3ph3-9j2qADVISORY
- https://github.com/encode/django-rest-frameworkPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/djangorestframework/PYSEC-2020-263.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-25626ADVISORY
- https://security.netapp.com/advisory/ntap-20201016-0003WEB
- https://www.debian.org/security/2022/dsa-5186WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan