CVE-2020-25626
mediumPriorität · verfolgen · 24EPSS 0.013 · 70. PerzentilEUUSEPSS · bewertet 2026-10-27
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenansible-tower-37/ansible-tower-rhel7@sha256:16bd1c27d796813ae58e6c5db4c05c9ff7125260b8c38434f73644bb299ca556_amd64 as a component of Red Hat Ansible Tower 3.7 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2020:4136 - Behobenansible-tower-36/ansible-tower@sha256:f964effe701f4b98e950c875eceb3e0201ce50c93e702e5c8da35434e55609eb_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2020:4137
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
- n/a Django REST Framework≤ All django-rest-framework versions before 3.12.0 and before 3.11.2enisa_euvdEU
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2020:4136Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container2020-09-30csaf · redhat_csafUS
Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container
- RHSA-2020:4137Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container2020-09-30csaf · redhat_csafUS
Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container
- GHSA-fx83-3ph3-9j2qCross-site Scripting (XSS) in Django REST Framework2021-03-19ghsa · osvUS
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
- PYSEC-2020-2632020-09-30vendor · osvUS
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (17)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2020-25626cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1878635cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-25626cnnvd
- https://packetstormsecurity.com/files/159412/Red-Hat-Security-Advisory-2020-4137-01.htmlcnnvd
- https://packetstormsecurity.com/files/169272/Debian-Security-Advisory-5186-1.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20201016-0003/cnnvd
- https://vigilance.fr/vulnerability/Ansible-Tower-Cross-Site-Scripting-33460cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3412/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan