GHSA-9r8w-6x8c-6jr9

Suggest an improvement
Source
https://github.com/advisories/GHSA-9r8w-6x8c-6jr9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-9r8w-6x8c-6jr9/GHSA-9r8w-6x8c-6jr9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9r8w-6x8c-6jr9
Aliases
Published
2019-01-04T17:50:34Z
Modified
2024-05-07T21:01:37.446305Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Django vulnerable to XSS on 500 pages
Details

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.10.0
Fixed
1.10.8

Affected versions

1.*

1.10
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.11.0
Fixed
1.11.5

Affected versions

1.*

1.11
1.11.1
1.11.2
1.11.3
1.11.4