CVE-2020-25626
mediumpriority · track · 24EPSS 0.013 · 70 %ileEUUSEPSS · scored 2026-10-27
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedansible-tower-37/ansible-tower-rhel7@sha256:16bd1c27d796813ae58e6c5db4c05c9ff7125260b8c38434f73644bb299ca556_amd64 as a component of Red Hat Ansible Tower 3.7 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2020:4136 - Fixedansible-tower-36/ansible-tower@sha256:f964effe701f4b98e950c875eceb3e0201ce50c93e702e5c8da35434e55609eb_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2020:4137
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- n/a Django REST Framework≤ All django-rest-framework versions before 3.12.0 and before 3.11.2enisa_euvdEU
advisories (4)
Vendor and ecosystem advisories describing this.
- RHSA-2020:4136Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container2020-09-30csaf · redhat_csafUS
Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container
- RHSA-2020:4137Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container2020-09-30csaf · redhat_csafUS
Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container
- GHSA-fx83-3ph3-9j2qCross-site Scripting (XSS) in Django REST Framework2021-03-19ghsa · osvUS
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
- PYSEC-2020-2632020-09-30vendor · osvUS
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2020-25626cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1878635cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-25626cnnvd
- https://packetstormsecurity.com/files/159412/Red-Hat-Security-Advisory-2020-4137-01.htmlcnnvd
- https://packetstormsecurity.com/files/169272/Debian-Security-Advisory-5186-1.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20201016-0003/cnnvd
- https://vigilance.fr/vulnerability/Ansible-Tower-Cross-Site-Scripting-33460cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3412/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan