Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-7RP2-FM2H-WCHJ
HistoryJun 10, 2019 - 6:43 p.m.

Django Cross-site Scripting in AdminURLFieldWidget

2019-06-1018:43:25
CWE-79
GitHub Advisory Database
github.com
15

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

79.7%

JSON

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

CPENameOperatorVersion
djangolt2.2.2
djangolt2.1.9
djangolt1.11.21

Related

fedora 4
veracode 1
osv 5
debian 3
openvas 10
ubuntucve 1
alpinelinux 1
archlinux 2
nessus 8
cve 1
prion 1
redhatcve 1
debiancve 1
freebsd 1
attackerkb 1
ubuntu 1
suse 2
altlinux 2
gentoo 1
fedora
fedora
[SECURITY] Fedora 30 Update: python-django-2.1.9-1.fc30
2019-06-12 14:48:36
[SECURITY] Fedora 30 Update: python-django-2.1.10-1.fc30
2019-07-13 01:07:30
[SECURITY] Fedora 30 Update: python-django-2.1.11-1.fc30
2019-08-15 18:10:42
veracode
veracode
Cross-site Scripting (XSS)
2019-06-04 02:09:04
osv
osv
Django Cross-site Scripting in AdminURLFieldWidget
2019-06-10 18:43:25
CVE-2019-12308
2019-06-03 17:29:01
PYSEC-2019-79
2019-06-03 17:29:00
debian
debian
[SECURITY] [DLA 1842-1] python-django security update
2019-07-01 20:56:20
[SECURITY] [DLA 1814-1] python-django security update
2019-06-05 10:04:24
[SECURITY] [DSA 4476-1] python-django security update
2019-07-05 18:03:12
openvas
openvas
Django AdminURLFieldWidget XSS Vulnerability - Windows
2019-06-26 00:00:00
Fedora Update for python-django FEDORA-2019-57a4324120
2019-06-13 00:00:00
Django AdminURLFieldWidget XSS Vulnerability - Linux
2019-06-26 00:00:00
ubuntucve
ubuntucve
CVE-2019-12308
2019-06-03 00:00:00
alpinelinux
alpinelinux
CVE-2019-12308
2019-06-03 17:29:00
archlinux
archlinux
[ASA-201906-1] python2-django: cross-site scripting
2019-06-04 00:00:00
[ASA-201906-2] python-django: cross-site scripting
2019-06-04 00:00:00
nessus
nessus
Debian DLA-1814-1 : python-django security update
2019-06-07 00:00:00
Fedora 30 : python-django (2019-57a4324120)
2019-06-13 00:00:00
Debian DLA-1842-1 : python-django security update
2019-07-02 00:00:00
cve
cve
CVE-2019-12308
2019-06-03 17:29:00
prion
prion
Code injection
2019-06-03 17:29:00
redhatcve
redhatcve
CVE-2019-12308
2020-04-09 10:36:35
debiancve
debiancve
CVE-2019-12308
2019-06-03 17:29:00
freebsd
freebsd
Django -- AdminURLFieldWidget XSS
2019-06-03 00:00:00
attackerkb
attackerkb
CVE-2019-11358
2019-04-20 00:00:00
ubuntu
ubuntu
Django vulnerabilities
2019-07-01 00:00:00
suse
suse
Security update for python-Django (moderate)
2019-08-14 00:00:00
Security update for python-Django (moderate)
2019-08-08 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package python3-module-django version 2.2.3-alt1
2019-07-15 00:00:00
Security fix for the ALT Linux 9 package python3-module-django version 2.2.3-alt1
2019-07-15 00:00:00
gentoo
gentoo
Django: Multiple vulnerabilities
2020-04-30 00:00:00

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

79.7%

JSON
Related for GHSA-7RP2-FM2H-WCHJ
fedora4veracode1osv5debian3openvas10ubuntucve1alpinelinux1archlinux2nessus8cve1prion1redhatcve1debiancve1freebsd1attackerkb1ubuntu1suse2altlinux2gentoo1