XSS in Django
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-13596US | medium6.1 | — | ||
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leadin… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.djangoproject.com/en/3.0/releases/securityWEB
- https://github.com/advisories/GHSA-2m34-jcjv-45xfADVISORY
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/1f2dd37f6fcefdd10ed44cb233b2e62b520afb38WEB
- https://github.com/django/django/commit/6d61860b22875f358fac83d903dc629897934815WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-32.yamlWEB
- https://groups.google.com/forum/#!msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan