GHSA-x9jp-4w8m-4f3c

Source

https://github.com/advisories/GHSA-x9jp-4w8m-4f3c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-x9jp-4w8m-4f3c/GHSA-x9jp-4w8m-4f3c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x9jp-4w8m-4f3c

Published

2022-06-10T19:51:18Z

Modified

2024-12-07T05:41:09Z

Summary

Cross Site Scripting vulnerability in django-jsonform's admin form.

Details

Description

django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.

This only affects the admin pages where the django-jsonform is rendered.

Mitigation

Upgrade to django-jsonform version 2.10.1 or later.

For more information

If you have any questions or comments about this advisory:

Open an issue.
Email the maintainer at Bharat Chauhan <tell.bhch@gmail.com>.

Database specific

{
    "cwe_ids":  [
        "CWE-79",
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-10T19:51:18Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / django-jsonform

Package

Name: django-jsonform; View open source insights on deps.dev
Purl: pkg:pypi/django-jsonform

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.10.1

Affected versions

0.*

0.9.0

1.*

1.0.0

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.8.0

2.8.1

2.9.0

2.10.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-x9jp-4w8m-4f3c/GHSA-x9jp-4w8m-4f3c.json"