GHSA-9r8w-6x8c-6jr9

Suggest an improvement
Source
https://github.com/advisories/GHSA-9r8w-6x8c-6jr9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-9r8w-6x8c-6jr9/GHSA-9r8w-6x8c-6jr9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9r8w-6x8c-6jr9
Aliases
Published
2019-01-04T17:50:34Z
Modified
2024-09-18T16:08:42.190901Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Django vulnerable to XSS on 500 pages
Details

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.10a1
Fixed
1.10.8

Affected versions

1.*

1.10a1
1.10b1
1.10rc1
1.10
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.11a1
Fixed
1.11.5

Affected versions

1.*

1.11a1
1.11b1
1.11rc1
1.11
1.11.1
1.11.2
1.11.3
1.11.4