GHSA-7rp2-fm2h-wchj

Suggest an improvement
Source
https://github.com/advisories/GHSA-7rp2-fm2h-wchj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-7rp2-fm2h-wchj/GHSA-7rp2-fm2h-wchj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7rp2-fm2h-wchj
Aliases
Published
2019-06-10T18:43:25Z
Modified
2024-09-20T16:08:49.798165Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Django Cross-site Scripting in AdminURLFieldWidget
Details

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

Database specific
{
    "nvd_published_at": "2019-06-03T17:29:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-10T18:41:42Z"
}
References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.11a1
Fixed
1.11.21

Affected versions

1.*

1.11a1
1.11b1
1.11rc1
1.11
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.16
1.11.17
1.11.18
1.11.20

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1a1
Fixed
2.1.9

Affected versions

2.*

2.1a1
2.1b1
2.1rc1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.7
2.1.8

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2a1
Fixed
2.2.2

Affected versions

2.*

2.2a1
2.2b1
2.2rc1
2.2
2.2.1