PYSEC-2022-19

vendorUSosv

view advisory published 2022-02-03Licence: CC-BY-4.0

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-22818US	medium6.1	3.36% (89th)	Exploit	2022-02-03
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

references

External citations — patches, advisories, analysis.

https://docs.djangoproject.com/en/4.0/releases/security/WEB
https://github.com/advisories/GHSA-95rw-fx8r-36v6ADVISORY
https://groups.google.com/forum/#!forum/django-announceWEB
https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ARTICLE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan